|From: ronnie sahlberg
|
[snip]
|Serious one:
|It creates a lot of hf fields with the same abbrev such as
|"iax2.iax.unknowndata"
|Ethereal doesnt really like to have multiple different hf fields with
|the same abbrev.
|This one must be fixed.
I would not state it this way. Ethereal allows registering *different* hf
variables with the *same* abbrev. The advantage this approach offers, is
that a given protocol field may appear as either a 16 bit or 32 bit or text
string value. While dissecting the protocol field, one could then use the
adequate header field variable based on the encoded type. As a result, if an
end-user writes a display filter with such a "duplicated" abbrev, the filter
will match all packets having this field, irrespective of the field data
type.
The only issue one could encounter is that checking for a given value for
such a field may cause trouble in the display filter compiler, as the field
must support the selected operation... for all the encoding types it has
defined (hint: ftype_can_XXX() methods).
Regards,
Olivier