Why add these as hidden fields?
A lot of other dissectors add flags for duplicate detection and also error
conditions and
make them visible in the dissect tree.
This makes it easier for users to see that the fields exist and that they
can filter on them.
(Menu:Match/Selected works)
Why not add these fields to the dissect tree as visible fields?
----- Original Message -----
From: "Martin Mathieson"
Sent: Monday, April 19, 2004 9:16 PM
Subject: [Ethereal-dev] [PATCH] SIP hidden fields for finding errors
> The attached patches add 2 hidden display filters for SIP - namely:
> (1) sip.error (for all responses with code >= 300)
> (2) sip.resend (for all packets that appear to have been retransmitted).
A
> field showing a count of these is shown in the SIP stats window.
>
> These filters make it much easier to zero in on problems in large captures
> (e.g. bulk call tests) evident from the SIP stats window.
>
> (1) is straightforward, and needed because the response code is regarded
as
> a string, so its not easy to write your own expression
>
> (2) is more involved, and I would like to hear from other SIP users about
> this addition. Some notes:
> - Only considers UDP packets
> - Hash table contains (call_id, source_addr, dest_addr) -> (cseq,
> simplified transaction_state).
> An earlier version used proper conversations but the call-id is the most
> important part of the key. Addresses are still needed for when e.g. more
> than one leg of a proxied call is in the same capture.
> - Size of hash table key and value memchunks (as number of elements) are
> settable as a SIP property so as not to waste memory but to still allow
> large values
>
> Regards,
> Martin
>
----------------------------------------------------------------------------
----
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev
>