> > Well, I'm not one of the streaming guys in the NetCache group here at
> > NetApp, so it wouldn't make a difference to me; however, note that you
> > can include columns in the summary for the source and destination port
> > number of the packet - see the "Columns" tab in the "Edit->Preferences"
> > dialog box. (Note that the new columns currently don't show up until
> > you exit Ethereal and restart, after saving the preferences with the
> > "Save" button; that will probably be fixed at some point.)
> >
>
> Ah-hah! I did not realize this! Is there any way to do this in tethereal
> too?
Yes. See below.
> > Well, "udp.srcport" could, as indicated above, be shown if you select
> > "Src port" as one of the columns.
>
> Sorry, I guess I wasn't very clear. I meant in tethereal.
So did I. In recent versions of Tethereal, the columns printed when you
run Tethereal without "-V" are the columns specified by your preferences
file.
You would have to edit the preferences file either from Ethereal or by
hand with your Friendly Neighborhood Text Editor; there's currently no
command-line option to change the columns to be displayed.
Note that I didn't mention "sip.msg_hdr"; that's because there's no
column corresponding to it, so it can't be displayed using that
technique.
> That is a good solution...except if you want to get into graphing stuff.
And if you want to get into graphing stuff, the dissectors should still
supply only the raw data; other code should draw the pictures. (For one
thing, that'd let you, for example, support drawing bar charts, or pie
charts, or..., without having to have the dissectors know about drawing
particular types of charts.)
> I'm not there yet, but here's my proposed solution:
>
> There's a register_summary function where you pass it the proto_id, the
> short name, a pointer to a gtk function that takes a conversation_t
> argument and a gpointer argument that points to a GTKWidget container (i.e.
> the summary window would already be created and the function would get
> passed the container GTKWidget in gpointer form.
The function could not be part of the dissector, and even a declaration
of a function elsewhere could not be seen by the dissector; with a tiny
number of exceptions, the letters "g", "t", and "k" should not appear,
in that sequence, in any dissector (regardless of the case of the
letters).