Wireshark · Ethereal-dev: Re: [Ethereal-dev] patch to packet-isup.c: use message acronyms in the Info: column

[Guy Harris <guy@xxxxxxxxxx>]

On Fri, Apr 11, 2003 at 03:45:54PM -0400, Jeff Morriss wrote:
> Guy Harris wrote:
> > Your new code doesn't clear the Info column out, so whatever stuff SCTP
> > and MTP3 or M3UA put there put there will remain there; is that
> > intentional?
> 
> Actually, yes:  SCTP, M2PA, MTP3, and (hopefully--I haven't checked) 
> M3UA don't put anything in the Info column if a subdissector was called.

OK, I've checked it in.

The problem there is that there's only one Info column value.  If we
had, instead, a stack of them, so that if dissector X updates the Nth
value in the stack, and it calls dissector Y, dissector Y updates the
N+1st value in the stack, the Info column could display information
about the topmost protocol without having information from multiple
layers mixed in.

Now, if we either

	1) wanted to significantly *increase* the memory requirements
	   for Ethereal (and increase the CPU requirements for the
	   initial pass through the packets as well)

or

	2) made random access even to gzipped captures fast (somebody
	   here at NetApp said that, by saving the dictionary
	   information - which increases the memory requirements, but
	   perhaps not by an inordinate amount - it'd be possible to do
	   so), and removed the ability to sort packets based on the Info
	   column value (or maybe only made it painful to do so)

we could perhaps arrange to have a display option to let you see the
Protocol and Info column values for *all* protocol layers.  The Windows
Sniffer software has such an option.