Wireshark mailing list archives

Re: proto.h extension


From: Guy Harris <guy () alum mit edu>
Date: Fri, 8 May 2015 12:30:13 -0700


On May 8, 2015, at 12:13 PM, Evan Huus <eapache () gmail com> wrote:

It would be simpler and smarter if we just accounted for the fact when
aligning fields: if a field does not have a bitmask, but something
above/below it (in the same tree) does then indent it with the
appropriate number of spaces.

Presumably "something" means "a separate field occupying different bytes", so we don't, for example, get the top-level 
item for a MAC address indented to the same extent as its locally-vs-globally-administered and individual-vs-group bits.

That would produce output such as

Internet Protocol Version 4, Src: 10.120.4.1 (10.120.4.1), Dst: 224.0.0.5 (224.0.0.5)
    0100 .... = Version: 4
    .... 0101 = Header Length: 20 bytes
                Differentiated Services Field: 0xc0 (DSCP 0x30: Class Selector 6; ECN: 0x00: Not-ECT (Not ECN-Capable 
Transport))
                    1100 00.. = Differentiated Services Codepoint: Class Selector 6 (0x30)
                    .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
                Total Length: 64
                Identification: 0x2571 (9585)
                Flags: 0x02 (Don't Fragment)
                    0... .... = Reserved bit: Not set
                    .1.. .... = Don't fragment: Set
                    ..0. .... = More fragments: Not set
                Fragment offset: 0
                Time to live: 1
                Protocol: OSPF IGP (89)
                Header checksum: 0x64b6 [validation disabled]
                    [Good: False]
                    [Bad: False]
                Source: 10.120.4.1 (10.120.4.1)
                Destination: 224.0.0.5 (224.0.0.5)
                [Source GeoIP: Unknown]
                [Destination GeoIP: Unknown]

Is that what we want?

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe


Current thread: