Ulf Lamping:
> It's sometimes confusing to distinguish between protocol fields derived
> from the capture data and fields that are generated by Ethereal while
> dissecting "from knowledge" (e.g. from context information).
>
> Example:
>
> In the DCE-RPC dissecting are some protocol fields generated by
> knowlegde from context, like a hint to the response in a request packet,
> looking like.
>
> Response in frame: 10
>
> This means that the response PDU to the current one is in packet 10.
> This protocol field has no data representation inside the packet.
>
> From the DCE/RPC desegmenting, I got the idea to put some brackets
> (what's the correct english name for this brackets?) around the Ethereal
> generated info, so this will look like:
>
> [Response in frame]: 1
>
> I've checked in an example of this in the DCERPC dissector (but I can
> easily remove it again, if others really don't like it).
>
>
> What do others think of the idea, to put this brackets around field
> names of Ethereal generated protocol fields in general?
I think it is a good idea.
I'm right now implementing a plugin dissector where I have a lot of
"generated fields" that I want
to be dispalyed in the protocol tree but to be distinguished from the other
fields.
Putting the names in brackets seems nicer than the ideas I had.