This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Tshark custom columns: Why don’t I get an error message?

0
Correct syntax:
$ tshark -r test.pcap -R "frame.number<6" -o column.format:""No.","%m", "tcp.port", "%Cus:tcp.port", "udp.port", "%Cus:udp.port""
  1  55556,53
  2  53,55556
  3 1685,80
  4 80,1685
  5 1685,80

I get an error message, when I make a typo: %Cu:udp.port (instead of %Cus:udp.port) $ tshark -r test.pcap -R "frame.number<6" -o column.format:""No.","%m", "tcp.port", "%Cus:tcp.port", "udp.port", "%Cu:udp.port"" tshark: Invalid -o flag "column.format:No.,%m, tcp.port, %Cus:tcp.port, udp.port, %Cu:udp.port"

Why don't I get messages for the following typo's? $ tshark -r test.pcap -R "frame.number<6" -o column.format:""No.","%m", "tcp.port", "%Cus:tcp.port", "udp.port", "%Cust:udp.port"" 1 2 3 1685,80 4 80,1685 5 1685,80

$ tshark -r test.pcap -R "frame.number<6" -o column.format:""No.","%m", "tcp.port", "%Cus:tcp.port", "udp.port", "%Custttttttttttttt:udp.port"" 1 2 3 1685,80 4 80,1685 5 1685,80

asked 16 Jul ‘11, 00:41

joke's gravatar image

joke
1.3k4934
accept rate: 9%


One Answer:

2

The bug is that prefs.c:2044 and prefs.c:2069 compare only the first few characters of "%Custttttttttttttt", which match the expected string (%Cus):

const gchar *cust_format = col_format_to_string(COL_CUSTOM);
size_t cust_format_len = strlen(cust_format);
//...
if (strncmp(col_l_elt->data, cust_format, cust_format_len) == 0) {
        cfmt->fmt      = g_strdup(cust_format);
        prefs_fmt      = g_strdup(col_l_elt->data);
        cust_format_info = g_strsplit(&prefs_fmt[cust_format_len+1],":",3); /* add 1 for ':' */
        cfmt->custom_field = g_strdup(cust_format_info[0]);
//....

If we add 1 to cust_format_len, the string comparison would include the null terminator in cust_format, which would cause the desired syntax error:

if (strncmp(col_l_elt->data, cust_format, cust_format_len+1) == 0) {
//...

answered 16 Jul '11, 03:28

helloworld's gravatar image

helloworld
3.1k42041
accept rate: 28%

edited 16 Jul '11, 03:30

I will file a bug.
Thanks.

(16 Jul '11, 04:18) joke

The bug is fixed.
Thanks to Stig:
Added a fix in revision 38064.
Scheduled for 1.4.8 and 1.6.1.

You can download automated build 38064 here

(16 Jul '11, 12:45) joke