Wireshark-users: Re: [Wireshark-users] packet counter statistics for a dissector

From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
Date: Fri, 27 Feb 2009 11:42:35 -0500


Toralf F�rster wrote:
Hello,

for the attached dissector for the Lotus Notes Sametime protocol I added a packet counting statistics based on the Sametime Message Type.

If I click at Statistics -> Sametime -> Packet Counter and define "sametime" as the Filter string I get a correct statistics for the attached stream :
6 packets total, 4 with SET_USER_STATUS, 2 CHANNEL_SEND).

However if I do not define a filter string I get :
6 packets total, 6 CHANNEL_SEND

In general it seems that only the last Sametime Message Type is used if I do not define a filter string. I cannot find the culprit for that :-(

FWIW this is really a developer question--it might be better asked on the -dev list.

The usual cause for different behavior with and without a filter is that some (necessary to operate correctly) work is being done by the dissector inside an "if(tree)": 'tree' may be NULL if there's no filter but it won't be if there is a filter.