Wireshark-dev: Re: [Wireshark-dev] expert_add_info_format() usage with undecoded/unknown data

From: wsgd <wsgd@xxxxxxx>
Date: Fri, 27 Feb 2009 11:16:34 +0100
Guy Harris a �crit :
On Feb 24, 2009, at 1:26 PM, wsgd wrote:

I have tried your patch (on wireshark 1.1.3).
Seems to work well.

Explanations for other people :

On each field where an expert info has been declared,
a subtree Expert Info is added with
a field Severity with its value : Error, ...
a field Group with its value : Checksum, Malformed, ...
...and without the actual text of the expert information.
Ok, better.
It would probably be more useful *with* the text of the expert 
information; as long as we're adding the expert information to the 
protocol tree, we might as well show what the problem is.
I've attached a version of Jakub's patch that does that as well.
Tested ok (wireshark 1.1.3).
In addition, it might be useful to have a way to register particular 
expert information indications, so that you could search for packets 
with *specific* problems.  For those, you might have a particular 
indication registered as a pseudo-field for a protocol, e.g. 
"tcp.bad_checksum" if we used expert information to report bad TCP 
checksums.  That item could be added underneath the top-level "Expert 
Info" item, along with the severity and group.
------------------------------------------------------------------------



------------------------------------------------------------------------

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe

--
Wireshark Generic Dissector http://wsgd.free.fr