This is our old Q&A Site. Please post any new questions and answers at

hello, you can add a level of security and group for the coloring of the node. And how?

Below an example of using: expert_add_info_format(pinfo, flags_item, MY_PI_XXX, MY_PI_XXX, "Descrition");


asked 25 Jul '11, 15:49

Ignacio%20Rivera's gravatar image

Ignacio Rivera
accept rate: 0%

edited 25 Jul '11, 16:52

helloworld's gravatar image


Sorry, I'm not sure what the question is here.

You've quoted how to do it, for example:

expert_add_info_format(pinfo, flags_item, PI_WARN, PI_SECURITY, "Description");

See epan/proto.h for the defined PI_ values.

(26 Jul '11, 06:57) JeffMorriss ♦

Are you asking how to apply an expert level (in order to colorize a packet/node)? Or are you asking how to define a custom expert-info level? I don't believe custom expert levels are allowed.

(26 Jul '11, 07:02) bstn

Sorry, i am asking hoy define my new expert-info level and group. For example, PI_MY_LEVEL, and GROUP: MYGROUP.

(26 Jul '11, 09:11) Ignacio Rivera

(BTW, your answer should probably be converted to a comment.)

To create new expert-info levels and groups you'll have to modify Wireshark's source code. At least (and possibly only, but I haven't fully researched it) epan/proto.h and epan/expert.c .

permanent link

answered 26 Jul '11, 10:09

JeffMorriss's gravatar image

JeffMorriss ♦
accept rate: 27%

Ok. Thanks. Know when you are going to make configuration?

(26 Jul '11, 11:46) Ignacio Rivera

Sorry, what's the question?

(26 Jul '11, 12:06) JeffMorriss ♦

I think Jeff was suggesting that you make the change in your own sandbox to allow custom expert-info.

(26 Jul '11, 12:25) bstn

But I don't understand the advantage of adding a new expert-info. Is your primary goal to change the color of a packet/node? You can do that without a custom expert-info (the source already supports temp color filters).

(26 Jul '11, 12:26) bstn

Hmm, I don't know. There's no specific values requested here [to add to Wireshark]. And it does not make sense to have dynamic (run time) values because you have to COMPILE your dissector or plugin against whatever values you put in epan/proto.h .

You're right, maybe we need to back up and find out what the primary goal is here...

(26 Jul '11, 13:17) JeffMorriss ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 25 Jul '11, 15:49

question was seen: 2,538 times

last updated: 26 Jul '11, 13:17

p​o​w​e​r​e​d by O​S​Q​A