Stephen Fisher schrieb:
Shouldn't everything in the frame dissector tree be marked as generated
(with [ and ] brackets around it)? I was teaching a group about
Wireshark this evening and noticed that while most items have brackets, a
few don't:
When I added the generated "marks" to these fields, my idea I was: Which
information is in the capture file and which is generated later on by
Wireshark.
Arrival Time
Is in the capture file
Frame Number
Is derived from the read sequence, you may argue it's generated.
Frame Length
Capture Length
Are both in the capture file.
So we *might* want to mark the frame number as generated, but I don't
know if that's necessary.
The other three fields are actually in the capture file and should not
be marked as generated IMO ...
Regards, ULFL