Wireshark mailing list archives
Re: Info column with multiple PDUs in one frame
From: Thomas Wiens <th.wiens () gmx de>
Date: Wed, 25 Oct 2017 21:02:21 +0200
On 25.10.2017 18:36, Jeff Morriss wrote:
Typically how multiple PDUs are handled is by setting a "fence" in the INFO column. Calling col_clear() only clears as far back as the fence; this allows upper-layer dissectors to clear what the lower-layer dissector(s) put in the INFO column--but only for the current PDU. This is how SCTP-based protocols show multiple (bundled) PDUs in the INFO column. Check out the call to col_set_fence() in the SCTP dissector.
Thank you Jeff. As far as I can see, the STCP dissectory adds only a space between two PDU infos. The sample capture has only a single PDU in every frame. I think the vertical bar is acceptable as delimiter. col_proto = col_get_text(pinfo->cinfo, COL_PROTOCOL); if (col_proto && strcmp(col_proto, PROTO_TAG_S7COMM) == 0) { col_set_str(pinfo->cinfo, COL_INFO, " | "); } else { col_clear(pinfo->cinfo, COL_INFO); } I've searched for col_set_fence in the dissectors, and packet-sip.c is using also a vertical bar, but it's always added to the info column. With a XXX remark that it produces ugly output. -- Thomas ___________________________________________________________________________ Sent via: Wireshark-dev mailing list <wireshark-dev () wireshark org> Archives: https://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev mailto:wireshark-dev-request () wireshark org?subject=unsubscribe
Current thread:
- Info column with multiple PDUs in one frame Thomas Wiens (Oct 25)
- Re: Info column with multiple PDUs in one frame Jeff Morriss (Oct 25)
- Re: Info column with multiple PDUs in one frame Thomas Wiens (Oct 25)
- Re: Info column with multiple PDUs in one frame Pascal Quantin (Oct 25)
- Re: Info column with multiple PDUs in one frame Thomas Wiens (Oct 25)
- Re: Info column with multiple PDUs in one frame Jeff Morriss (Oct 25)