Wireshark-bugs: [Wireshark-bugs] [Bug 5703] frame.coloring_rule columns empty

Date: Thu, 10 Dec 2015 18:56:40 +0000

changed bug 5703


What Removed Added
CC   [email protected]

Comment # 7 on bug 5703 from
(In reply to Anders Broman from comment #5)

> Hmm not doing coloring on the first pass may have been part of the packet
> list optimization.

It is not an optimization, but a result of how it is implemented:

1. "prime" fields involves in filter rules (disable optimization that hides
trees)
2. start first pass dissection
3. frame dissection adds coloring rule to the tree (if it exists)
4. first pass dissection finishes
5. coloring rule is computed based on the tree.
6. colors are applied in the GUI

If the coloring rule shows up in the GUI, it is only by luck (a redissection
has happened and the GUI is updated). This happens for example when the columns
order is changed.

The second pass occurs only with tshark -2 or when a packet is selected in the
GUI.

In the linked patch I made a start on fixing the coloring rule detection into
the frame dissection (handling it like the frame.protocols field), but I would
like to get some input on the architectural implications (see commit message of
the WIP patch).


You are receiving this mail because:
  • You are the assignee for the bug.
  • You are watching all bug changes.