2008/3/5, Stephen Fisher <stephentfisher@xxxxxxxxx>:
> On Wed, Mar 05, 2008 at 08:34:10PM +0100, Stig Bjørlykke wrote:
>
> > We already have the cumulative number of bytes in the frame dissector
> > (used for the cumulative column), so it's just a matter of adding this
> > as a generated frame field.
>
> Do we? The Cumulative Bytes column is pulled out of
> pinfo->fd->cum_bytes.
My text should probably be: "in the frame_data struct" :)
But it's easy to add this as a generated frame field.
> Hmm.. what would frame.cum_len > 1000 do wrong? I guess it depends on if
> it's cumulative from the beginning of the capture or for displayed
> packets. That could get messy.
The cumulative bytes in the frame_data struct is for displayed
packets, which would never be greater than 0 when using this as
filter...
If this should work I suppose we should add yet another cumulative
bytes counter.
--
Stig Bjørlykke