Wireshark-dev: Re: [Wireshark-dev] What severity should be shown for multiple expert infos in a
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Mon, 17 Sep 2012 18:16:58 -0700
On Sep 17, 2012, at 6:04 PM, Michael Lum <michael.lum@xxxxxxxxxxxxxxxxx> wrote:

> I searched and couldn't find anything on multiple expert infos.
>  
> What severity level is supposed to be shown in the 'expert' column
> when there is more than one expert info in a packet?

Probably the highest severity.

> For example in one packet I have:
>  
> there was a UDP ERROR severity expert info for a bogus payload length
>  
> there was also a WARN severity expert info for a protocol dissected in
> the UDP payload.
>  
> The 'expert' column displayed WARN.
>  
> It seems like a bug.

Yes, it does; go ahead and file one on the bugzilla for this.