Wireshark-dev: Re: [Wireshark-dev] Philosophy around displaying all the fields in a capture

From: jay rock <jared.a.degler@xxxxxxxxx>
Date: Mon, 27 Jun 2022 19:29:42 -0700
What time are you thinking cause we have to go to my storage unit and I have to pull out the stuff and I need to make time available so my wife will be here with the kids

On Mon, Jun 27, 2022, 3:13 PM Martin Mathieson via Wireshark-dev <wireshark-dev@xxxxxxxxxxxxx> wrote:
Nice, I will check them out tomorrow.

Thanks,
Martin

On Mon, Jun 27, 2022 at 7:39 PM John Thacker <johnthacker@xxxxxxxxx> wrote:

On Mon, Jun 27, 2022, 12:20 PM Martin Mathieson via Wireshark-dev <wireshark-dev@xxxxxxxxxxxxx> wrote:
I have wondered before if a post-dissector could see skipped/overlapping fields and highlight them.

More likely, it could be an interesting project (for me, anyway) to play with a tool to:
- produce details of dissection (e.g. tshark -> PDML)
- walk the details of the fields, and look for discontinuities or overlaps in byte/bit coverage
- produce output that makes some kind of sense
      - I expect there'll be some obvious types of exceptions that will need to be filtered out, but when I think about the kinds of bugs I make in my private quick-and-dirty dissectors, this kind of coverage checking would be useful to me

The "incomplete_dissectors_check" preferences do that for skipped bytes and puts an expert item in the tree or writes to the console. Overlaps are probably more difficult for false positives, but the existing preferences are useful for debugging in the situation you mention.



John


___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives:    https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives:    https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe