I have 2 dissectors X and Y. If Y is present X calls Y or else it shows it as X. Now everything works fine. I have X and Y displaying on the PROTOCOL column in wireshark. Now I wanna see only X so I click on protocol button but now everything changes and only Y appears How do I make the COL_INFO and COL_PROTOCOL values unchangeable? They change every time i click on the "PROTOCOL" or "INFO" button. thanks in advance asked 28 Mar '11, 02:46  niks3089 |
2 Answers:
When you click on the Protocol or Info column headers, you are only causing Wireshark to sort the packets by whichever column header you selected. You are not filtering out any packets by doing this. If you only want to see packets displayed that are X, but not packets in which X calls Y, then you can use a display filter to do this, such as, " Now if you don't want Y replacing the contents of either the Protocol or Info columns when X does call Y, then you might want to have a look at some of the column utility functions, like answered 28 Mar '11, 10:39  cmaynard ♦♦ Actually I made a mistake. Its Y that is getting replaced by X. The above solution is not working (29 Mar '11, 00:00) niks3089 |
Make sure you set the COL_INFO and COL_PROTOCOL columns regardless of whether the "tree" argument to your dissector is null or not. answered 29 Mar '11, 00:09  Guy Harris ♦♦ It is set but the content keeps on changing (29 Mar '11, 06:14) niks3089 |
Can you be more specific? Are you writing a dissector which has a subdissector that may or may not be present, or one that is called if and only if a certain field has a specific value, or something else? Additionally, what buttons are you talking about? If you mean the column headers, then what is happening is a sort, not a relabeling.
It is not sorting. The protcol X is not present. I am calling the Y sub dissector from only X . So if X is present then so is Y . But when press the column headers all the protocols other than X and Y sort but Y replaces the occurances of X . hope you understood
So do you mean that when you read in a capture, or perform a capture, packets that have protocol Y running atop protocol X show protocol X's name in the Protocol column and the info for protocol X in the Info column, but when you try to sort on the Info or Protocol columns the Protocol column for those packets changes to show protocol Y's name and the Info column for those packets changes to show protocol Y's info?