while building a dissector, Is it possible to declare an error on the upper box?

Question

Hey, I'm building a dissector and wanted to know if it is possible declare an error on the upper box, where all the packets are (tcp ...)

By declaring I mean to get the color of the column red...

I know it is possible to declare and color the column in red on the middle box (where the description of the packets is found), but I want to see if it is also possible to the upper box...

Or, the only way to do it is to make it by the hand with view>>coloring rules and create some error flag which will be up in an error, and then I'll color it ?

thanks ahead

Accepted Answer

Use expert_add_info_format() to add an error flag to the packet, which will make the row in the middle pane red, and then add a coloring rule with a filter expression of

expert.severity == "Error"

(exactly like that, complete with the quotes around Error) and with your choice of background color (red, presumably - #FF5C5C is probably closes to the red used in the packet detail pane). Put that rule at the beginning of the list of coloring rules, so that it overrides all rules below it.

Answer 2

http://ask.wireshark.org/questions/9511/is-it-possible-to-set-the-coloring-of-a-packet-from-a-dissector