|
I wanted to highlight certain messages as red, blue
or green. So, following the advice of this list, I added three hidden
fields:
{
&hf_scap_red,
{ "Red Flag -- Error
Message", "scap.display_red",FT_BOOLEAN, BASE_NONE, NULL, 0x0, "", HFILL
}
},
{
&hf_scap_green,
{ "Green Flag -- Start of
Call", "scap.display_green",FT_BOOLEAN, BASE_NONE, NULL, 0x0, "", HFILL
}
},
{
&hf_scap_blue,
{ "Blue Flag -- End of
Call", "scap.display_blue",FT_BOOLEAN, BASE_NONE, NULL, 0x0, "", HFILL
}
}
Then as the packets are received by ethereal, I do
a quick check and set the appropriate field:
E.g:
switch (scap_msg_type)
{
case
CDMA_SDF_Release_Resource:
release_cause = VALUE16(tvb, offset +
32);
/*fprintf(stderr,"Release Cause:
%04x",release_cause);*/
/*if not normal release tag it red
*/
if ( release_cause != 0x1100 )
{
/*fprintf(stderr,"Frame: %d, Release Cause: %04x\n", pinfo->fd->num,
release_cause);
*/
proto_tree_add_boolean_hidden(tree, hf_scap_red, tvb, NULL, NULL,
TRUE);
} else
{
proto_tree_add_boolean_hidden(tree, hf_scap_blue, tvb, NULL, NULL,
TRUE);
}
:
:
Then I defined the following filters (from
colorfilters)
The problem I have is that messages at random are
showing up in different colors, or all messages show up in the same color (see
the if statement above). I noticed if I change the order of the filters (i.e.
put blue first and then red) it somewhat seems to colorize as I want. I only
added the hf_scap_blue because all of my messages where getting displayed in
red.
For some other message types, I added green color.
At this point I started noticing showing up in green randomly. What am I doing
wrong?
Also, I noticed cpu utilization goes up quite a bit
with colorize display. Is this normal?
Regards,
Sal
|