Re: Info column with multiple PDUs in one frame

[Pascal Quantin <pascal.quantin () gmail com>]

Hi Thomas,

2017-10-25 21:02 GMT+02:00 Thomas Wiens <th.wiens () gmx de>:

> On 25.10.2017 18:36, Jeff Morriss wrote:
>
> > Typically how multiple PDUs are handled is by setting a "fence" in the
> INFO
> > column.  Calling col_clear() only clears as far back as the fence; this
> > allows upper-layer dissectors to clear what the lower-layer dissector(s)
> > put in the INFO column--but only for the current PDU.
> >
> > This is how SCTP-based protocols show multiple (bundled) PDUs in the INFO
> > column.  Check out the call to col_set_fence() in the SCTP dissector.
>
> Thank you Jeff.
> As far as I can see, the STCP dissectory adds only a space between two
> PDU infos. The sample capture has only a single PDU in every frame.
>
> I think the vertical bar is acceptable as delimiter.
>
> col_proto = col_get_text(pinfo->cinfo, COL_PROTOCOL);
> if (col_proto && strcmp(col_proto, PROTO_TAG_S7COMM) == 0) {
>     col_set_str(pinfo->cinfo, COL_INFO, " | ");
> } else {
>     col_clear(pinfo->cinfo, COL_INFO);
> }
>
> I've searched for col_set_fence in the dissectors, and packet-sip.c is
> using also a vertical bar, but it's always added to the info column.
> With a XXX remark that it produces ugly output.

You should have a look at col_append_sep_str() that automatically add the
specified separator when required.

Pascal.

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe