Wireshark · Wireshark-dev: Re: [Wireshark-dev] [Wireshark-commits] master 8d65ccf: Show answers a line at a time, after the req

[Guy Harris <guy@xxxxxxxxxxxx>]

On Dec 25, 2019, at 10:44 AM, Maynard, Chris <Christopher.Maynard@xxxxxxx> wrote:

> Or revert this change so whois.answer reflects the entire answer again, but add each line underneath the answer using a different filter, such as "whois.answer.line"?

We could, but I think going back to the way it was before would be a bad idea.

> I would prefer this solution as the answer is the entire answer and each line is only part of the answer.

The argument could be made for other text protocols.  The problem is that "the entire answer" is hard to read.

> For example:
> V WHOIS: Answer
>           V Answer [truncated]: % IANA WHOIS server\n% for more information on IANA, visit http://www.iana.org\n% This query returned 1 object\n\n domain:       EXAMPLE.COM\n\norganisation: Internet Assigned Numbers Authority\n\n created:      1992-01-

Note the word "truncated" here.  That's not a good thing.

>                    Line 1: % IANA WHOIS server\n
>                    Line 2: % for more information on IANA, visit http://www.iana.org\n
>                    Line 3: % This query returned 1 object\n
>                    Line 4: \n
>                    Line 5: domain:       EXAMPLE.COM\n
>                    Line 6: \n
>                    Line 7: organisation: Internet Assigned Numbers Authority\n
>                    Line 8: \n
>                    Line 9: created:      1992-01-01\n
>                    Line 10: source:       IANA\n
>                    Line 11: \n

Something that displays it in *that* fashion, with each line shown underneath an item for the entire {WHOIS answer, SMTP mail message, HTTP/SIP/etc. header, HTTP text payload, etc.}, might be the right way to handle text protocols.

And, given that, is there any need to show the full text in the top-level item?