> Is there any way of automatically highlighting the output if for example the
> checksum in a packet is not correct, or if any of the length fields do not
> make sense?
There isn't one currently.
One thing I was thinking of (I think some other packet analyzer may
have this) is a way of being able to flag a protocol tree item as being
"in error" - this could be used for incorrect checksums, bogus length
values, enumerated-type values that aren't any of the known types, etc.
(although "enumerated-type values that aren't any of the known types"
could be that way either because the value is wrong or because Ethereal
doesn't know about that type value, so that one could be tricky).
If we had a special display-filter term "error" that matched a packet
iff it had a protocol tree item flagged as being in error, one could
have a colorization rule to make the packet-list line for those
packets show up in another color;
filter the display to show all such packets;
search for packets with protocol errors in them with "Find
Frame".
Ethereal could also (if the CTree widget supports that) display those
protocol-tree lines in a different color.