On Sun, Aug 21, 2005 at 05:40:24PM +0200, Ulf Lamping wrote:
> As an attempt to bring some kind of expert mode into life, I've started
> to add some more flags to the protocol items.
Great!
> The protocol item in the protocol tree will have a gray background now,
> which makes it much better visible.
>
> Add some more optional flags to the protocol items, so more "special
> cases" can be marked in the protocol tree. What came to my mind:
>
> /** The protocol field has a bad checksum */
> FI_CHECKSUM_ERROR
> /** The protocol field has an unusual sequence (e.g. TCP window is zero) */
> FI_SEQUENCE_WARNING
> /** The protocol field has a bad sequence (e.g. TCP segment is lost) */
> FI_SEQUENCE_ERROR
I think that this approach is a bit inflexible as we need global flags for
protocol specific intelligence.
How about a two-part value (like syslog):
1) a (global) severity (e.g. info, warn, error, security)
2) a (protocol specific) meaning (e.g. tcp: window, wrong seqno, etc)
The severity can then be used to filter (and apply colours) packets,
the protocol specific meaning can be used to display what is going on.
Ciao
Joerg
--
Joerg Mayer <jmayer@xxxxxxxxx>
We are stuck with technology when what we really want is just stuff that
works. Some say that should read Microsoft instead of technology.