Ethereal-dev: Re: [Ethereal-dev] Ethereal highighting

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxx>
Date: Fri, 2 Nov 2001 16:01:42 -0800 (PST)
> I think I'm close here.  My original request was to highlight an entire 
> line. [Highlighting an individual item within a protocol tree is an 
> excellent idea, albeit one I can wait for.]

"An entire line" where?

In the first pane, which lists packets?

Or in the second pane, which shows the protocol tree?

You didn't indicate that in your orignal message; what you said in your
original message was

	Ethereal Team, I was wondering if it's possible to setup
	Ethereal to highlight in some manner (reverse video is one way)
	line items that show errors.  Examples include IP or TCP
	checksum errors (now marked with an "incorrect" , so it would be
	easy to add the highlight indication these points).

The lines containing the IP and TCP checksum, and the word "incorrect"
if the checksum is incorrect, are lines in the protocol tree, not in the
packet summary window.

So did you mean that you wanted to highlight the IP or TCP checksum
line, in the second (protocol-tree) pane, if the checksum was incorrect,
or that you wanted to highlight the line in the *first* (packet list)
pane if the packet contained, say, an incorrect checksum?

If the latter, rather than the former, then the way to implement that is
to

	1) have either the per-protocol-tree-item error flag, as per my
	   previous mail, or an error flag in the "packet_info"
	   structure;

	2) have a new display-filter keyword "error", that can be used
	   to test that flag.

Once you have that, you can use the *existing* color filter mechanism to
specify that all frames for which the display-filter expression "error"
is true be given a particular foreground and background color.

No GUI changes whatsoever are needed to implement this, so none of the
URLs for the GTK+ Web site are needed, and no changes to any code in the
"gtk" subdirectory are needed (well, a change to the dialog box for
constructing packet filters might be necessary to handle "error", as it
would neither be registered as a protocol nor as a field for a
protocol).

This would also let you specify "error" as a display filter, and show
only the frames with errors, *and* specify "error" in the dialog box
popped up when "Edit->Find Frame" is selected, and search forwards or
backwards in the capture for a frame with an error.