[Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>]

On Thu, Dec 22, 2016 at 10:04 AM, Paul Offord <Paul.Offord@xxxxxxxxxxxx> wrote:

Hi,

 

I upgraded from 2.2.2 to 2.2.3 a few days ago.  I have a dissector( written in C) that I wrote a while back that works OK with 2.2.2 but not 2.2.3.  With the latter, on Wireshark start up I get:

 

  14:49:57          Err  Field 's-sitename' (iis_log.s_sitename) is a FT_ABSOLUTE_TIME but is being displayed as BASE_NONE instead of as a time

 

[...]

    { &hf_iis_s_sitename,

    { "s-sitename", "iis_log.s_sitename",

    FT_STRING, BASE_NONE, NULL, 0x0,

    "IIS site name", HFILL } },

I’m going to do some debugging this evening but I wondered if there have been any changes made to field registration.

 

Are you sure your dissector is compiled against the 2.2 branch?  FT_ABSOLUTE_TIME changed values in the master branch recently (I39a9f0dda0bd7f4fa02a9ca8373216206f4d7135) but it doesn't appear to have changed recently in master-2.2.