This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I have a plugin dissector which may attach expert info to a packet as shown below:

if(EXPERT_CONDITION(p_item))
{
    expert_add_info_format(pinfo, p_item, PI_PROTOCOL, PI_WARN, "expert warning");
}

Here, EXPERT_CONDITION is a macro that examines the data in p_item (equivalent to the code given in my answer here). I have captures where this expert info is visible in the tree, but no other expert info is present in the packet. In these captures, if I put expert in the filter pane, these marked packets do not show up. If I look in the Expert Infos dialog, I see Warnings: 0 (0).

Because of this I can't filter on packets in my protocol with an expert info that is specific to my protocol. How can I change my code so that the expert-info marked packets of my protocol are correctly filterable?

asked 13 Jan '12, 07:55

multipleinterfaces's gravatar image

multipleinte...
1.3k152340
accept rate: 12%


Are you calling expert_add_info_format() from within an if (tree) {} block, perhaps? This needs to be called whether the tree is NULL or not. The README.developer document doesn't explicitly mention the expert infos, but the following excerpt does apply to expert infos as well:

   Note, however, that you must fill in column information, create
   conversations, reassemble packets, build any other persistent state
   needed for dissection, and call subdissectors regardless of whether
   "tree" is NULL or not.
permanent link

answered 13 Jan '12, 17:18

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142
accept rate: 20%

This is the problem. I checked by rearranging a small portion of my dissector so the expert logic for one specific case would be run regardless of the tree. As expected, the filter expert correctly displays those packets, but still misses other marked packets that depend on tree.

(17 Jan '12, 08:32) multipleinte...
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×637
×349
×165
×158
×16

question asked: 13 Jan '12, 07:55

question was seen: 2,222 times

last updated: 17 Jan '12, 08:32

p​o​w​e​r​e​d by O​S​Q​A