Wireshark-dev: [Wireshark-dev] Checksum filterable fields
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: mmann78@xxxxxxxxxxxx
Date: Thu, 27 Jun 2013 08:58:58 -0400 (EDT)
Bug 8858 (https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8858) reminded me of something I noticed when trying to apply the new filterable expert info API - there isn't a consistency among dissectors to note a good or bad checksum.
 
I've seen
1. Checksum field (no verification)
2. Checksum field + append_text with good/bad (or only bad)
3a. Checksum field + "bad" field filter (field is treated as "present")
3b. Checksum field + "bad" field filter (field is boolean, so good can be separated from bad)
4. Checksum field + "bad" field filter + expert_info
5. Checksum field + "bad" field filter + "good" field filter
6. Checksum field + "bad" field filter + "good" field filter + expert_info
 
The ones that really seem excessive are 5 & 6 - do we really need this duplication? <dissector>.bad_checksum = TRUE equals <dissector>.good_checksum = FALSE.  Could we consolidate all (that have checksum verification) to
 
Checksum field + "good" boolean field filter (of the form <dissector>.good_checksum) + expert_info for bad checksum (of the form <dissector>.bad_checksum)
 
 
Opinions welcome.