Just let me know if you want me to keep track of the changed "first field of a protocol filter" for release note purposes. Per bug 2794, I planned on changing a bunch once I can come up with a consistent naming convention (and then change dissectors to follow that convention). The two biggest areas are "multiple subdissectors of a particular protocol" (ie H.248) and "common collection of protocols" (ie zbee, scsi). My current thought is to have "multiple subdissectors of a particular protocol" keep the dot notation, (ie h248.<subprotocol>.<subprotocol field>) and have the "common collection of protocols" have an underscore inbetween (ie zbee_<protocol>.<subprotocol field>). Comments are welcome.
Technically, I don't think ntppriv -> ntp.priv shouldn't need to be noted because "ntppriv" is not a dissector. Those fields are part of a structure within "ntp". To me this was one of the goals of bug 2794 - to ensure the first field always correponds to a dissector filter name.
-----Original Message-----
From: Joerg Mayer <jmayer@xxxxxxxxx>
To: wireshark-dev <wireshark-dev@xxxxxxxxxxxxx>
Sent: Sun, Jul 22, 2012 7:55 am
Subject: Re: [Wireshark-dev] [Wireshark-bugs] [Bug 2794] Questionable display filter fields