Wireshark · Ethereal-dev: Re: [Ethereal-dev] Re: Ethereal Gripe

[Kevin <kem2@xxxxxxx>]

Comment from a heavy user of ethereal.  I am not a developer in any 
manner, but my team and I do use ethereal daily.

Acterna Examine has / had the ability to insert a user definable 
protocol layer into the decode.  Then filters can be applied to this 
layer using the defined field names.

Just the ability to break out and display these proprietary or new 
fields is a godsend.  Any relationships between the fields is 
determined by the user.

I have been watching this thread and for what it is worth, would like 
to submit this list of features I would like, at least as a 1st 
generation.

Define fields as bits, or octets.
Label these fields
Assign a display data type (Boolean, Ascii, Hex, Octal, Bin)
Select which fields to display on the summary line
Define where in the stack this custom layer lives
Filter / Colorize on the defined fields.

Having to use Decode As... would not be a major burden.  Just the 
ability to break out there protocols is a major accomplishment.  Once 
this is in use in the field, it will be clearer what else is needed and 
how to grow the tool.

Just my $.02

Thanks to all for this fantastic tool
Kevin Mason