Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 7222] Saving a file may discard comments

[bugzilla-daemon@xxxxxxxxxxxxx]

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7222

--- Comment #10 from Guy Harris <guy@xxxxxxxxxxxx> 2012-06-05 00:53:48 PDT ---
(In reply to comment #4)
> My understanding is that wireshark has never aimed for supporting to write many
> file formats (only for reading them).

Well, not exactly.  Wireshark supports reading from many more formats than
those to which it supports writing, but it *does* support a number of formats
other than pcap and pcap-ng; presumably people contributed that support because
it was useful.

> I guess pcapng would be sufficient for
> everything people would ever want in a capture file.

For everything people would ever want in a capture file for a capture done in
Wireshark, probably; however, not all link-layer header types that are
supported by all the file formats Wireshark can read have LINKTYPE_ values.

In addition, some programs that people might want to use to read captures might
not read pcap or pcap-ng files; in the past, I've saved files in non-pcap
format so that I could read them in programs that, for example, might have, at
the time, done a better job of dissecting some protocols.

> I've played a bit with the approach you outlined, see my attached patch. I only
> changed the linux code, not the win32 parts.
> "Save As" would be obsolete (i.e. the same as Save) if we only ever save as
> pcapng.

Well, not exactly - "Save" just saves on top of the existing file, "Save As"
lets you save to a different file with a different name or in a different
directory.

> My gut feeling is that the underlying issue must be addressed somehow before
> 1.8. People will try the comments and will be annoyed when they're discarded
> without any warning.

I wasted about a half an hour trying to track down a "bug" that was losing
comments before I realized that Wireshark was saving my pcap file in pcap
format by default, so I'd say "yes".

> I assume the gimp-like approach is too significant a change to get accepted
> quickly.

The GIMP's distinction between a "Save"/"Save As" function and an "Export"
function makes sense for other reasons, which is why I added that in the trunk.

However, I think "Save As" should support saving in other formats, for the
reasons listed above.  I think  LibreOffice has part of the right answer.

If you add comments to a file in a format that doesn't support them, and you do
"Save", perhaps Wireshark should pop up a warning dialog asking if you want to:

    delete the comments (in which case it would blindly discard all comments
you've added; at that point, that probably means the file has no unsaved
changes, as it originally had no comments, so there's nothing left to do unless
the file is a temporary file, in which case "Save" would pop up a dialog to
select the destination);

    save in a format that supports comments (in which case it'd pop up a "Save
As" dialog - you might well want to change the file name, especially if you're
using extensions, e.g. capture.pcap might be saved as capture.pcapng once
comments are added and it's saved in pcap-ng format);

    cancel the whole operation.

If you do "Save As" on a file with comments, then:

    if there's a format it can be saved in that supports comments, that should
be the initial (default) format in the Save As dialog (even if it's different
from the file's original format);

    if there's no such format, the current scheme for choosing a default format
should be used;

    if the default file format is one that doesn't support comments, *OR* if
you choose a format that doesn't support comments, Wireshark should pop up a
dialog asking if you want to delete the comments or not.  Whether that should
be done at the time you select the format or do the save is another matter - I
might vote for "at the time you do the save", so as not to pester the user
until he or she makes a final choice of file format.  "Delete the comments"
would remove the comments and save in the specified format; "Cancel" would just
take you back to the "Save As" dialog to choose a different format or cancel
out of the entire save operation.

BTW, Export Specified Packets should probably have a similar dialog - just
because you're only saving *some* packets, that doesn't mean you necessarily
want to lose the comments.

> 
> @core-developers:
> Could we have a comment about the best way forward?
> I'd like to come up with a solution that's acceptable before 1.8
> 
> Best regards,
> 
>    Martin

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.