This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Display Filter not working for newly added fields

0

My plugin postdissector dissects, and displays, newly added suboptions in the tcp options field. But I just noticed that I'm unable to filter these fields when I type tcp.options.foo in the filter bar(but tcp.options,foo still appears in the drop down box). When I type tcp.options.foo, it shows absolutely no packets. However, the filter seems to work just fine when I try to filter something like, say, tcp.options. What's the reason for this?

Edit: No one has any ideas? :(

asked 23 Aug '12, 21:46

SidR's gravatar image

SidR
245121722
accept rate: 30%

edited 24 Aug '12, 02:31


One Answer:

0

Unfortunately, there is only one postdissector as a "reference" (packet-prp.c). Did you check that? Maybe it helps to track down your problem.

BTW: is it possible to post the code of your post dissector (on pastebin.com or so...)?

Regards
Kurt

answered 26 Aug '12, 02:01

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

Thanks a lot for your reply Kurt. Just checked the packet-prp.c file, but I'm still unable to figure out where the problem might be.

I have pasted a part of my plugin post-dissector code here: http://pastebin.com/1kJ4fLHm

I'm sorry that I had to remove most of the data structures for my suboptions (which include some proprietary information), nevertheless all the essential parts have been included. I also recompiled my code with the above, but the problem persists.

(27 Aug '12, 02:08) SidR

Can anyone please tell me why the display filter does not work for the above code?

(28 Aug '12, 21:46) SidR