Wireshark · Wireshark-dev: Re: [Wireshark-dev] expert_add_info_format() usage with undecoded/unknown data

[wsgd <wsgd@xxxxxxx>]

Guy Harris a écrit :
> On Feb 24, 2009, at 1:26 PM, wsgd wrote:
>
> > I have tried your patch (on wireshark 1.1.3).
> > Seems to work well.
> >
> > Explanations for other people :
> >
> > On each field where an expert info has been declared,
> > a subtree Expert Info is added with
> > a field Severity with its value : Error, ...
> > a field Group with its value : Checksum, Malformed, ...
>
> ...and without the actual text of the expert information.
Ok, better.
> It would probably be more useful *with* the text of the expert 
> information; as long as we're adding the expert information to the 
> protocol tree, we might as well show what the problem is.
>
> I've attached a version of Jakub's patch that does that as well.
Tested ok (wireshark 1.1.3).
> In addition, it might be useful to have a way to register particular 
> expert information indications, so that you could search for packets 
> with *specific* problems.  For those, you might have a particular 
> indication registered as a pseudo-field for a protocol, e.g. 
> "tcp.bad_checksum" if we used expert information to report bad TCP 
> checksums.  That item could be added underneath the top-level "Expert 
> Info" item, along with the severity and group.
>
> ------------------------------------------------------------------------
>
>
>
> ------------------------------------------------------------------------
>
> ___________________________________________________________________________
> Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
> Archives:    http://www.wireshark.org/lists/wireshark-dev
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
>              mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe


--
Wireshark Generic Dissector http://wsgd.free.fr