Wireshark-dev: Re: [Wireshark-dev] Info column with multiple PDUs in one frame
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Thomas Wiens <th.wiens@xxxxxx>
Date: Wed, 25 Oct 2017 21:02:21 +0200
On 25.10.2017 18:36, Jeff Morriss wrote:

> Typically how multiple PDUs are handled is by setting a "fence" in the INFO
> column.  Calling col_clear() only clears as far back as the fence; this
> allows upper-layer dissectors to clear what the lower-layer dissector(s)
> put in the INFO column--but only for the current PDU.
> 
> This is how SCTP-based protocols show multiple (bundled) PDUs in the INFO
> column.  Check out the call to col_set_fence() in the SCTP dissector.

Thank you Jeff.
As far as I can see, the STCP dissectory adds only a space between two
PDU infos. The sample capture has only a single PDU in every frame.

I think the vertical bar is acceptable as delimiter.

col_proto = col_get_text(pinfo->cinfo, COL_PROTOCOL);
if (col_proto && strcmp(col_proto, PROTO_TAG_S7COMM) == 0) {
    col_set_str(pinfo->cinfo, COL_INFO, " | ");
} else {
    col_clear(pinfo->cinfo, COL_INFO);
}

I've searched for col_set_fence in the dissectors, and packet-sip.c is
using also a vertical bar, but it's always added to the info column.
With a XXX remark that it produces ugly output.

-- 
Thomas