Home page logo

wireshark logo Wireshark mailing list archives

Checksum filterable fields
From: mmann78 () netscape net
Date: Thu, 27 Jun 2013 08:58:58 -0400 (EDT)

Bug 8858 (https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8858) reminded me of something I noticed when trying to 
apply the new filterable expert info API - there isn't a consistency among dissectors to note a good or bad checksum.

I've seen
1. Checksum field (no verification)
2. Checksum field + append_text with good/bad (or only bad)
3a. Checksum field + "bad" field filter (field is treated as "present")

3b. Checksum field + "bad" field filter (field is boolean, so good can be separated from bad)

4. Checksum field + "bad" field filter + expert_info
5. Checksum field + "bad" field filter + "good" field filter
6. Checksum field + "bad" field filter + "good" field filter + expert_info

The ones that really seem excessive are 5 & 6 - do we really need this duplication? <dissector>.bad_checksum = TRUE 
equals <dissector>.good_checksum = FALSE.  Could we consolidate all (that have checksum verification) to

Checksum field + "good" boolean field filter (of the form <dissector>.good_checksum) + expert_info for bad checksum (of 
the form <dissector>.bad_checksum)

Opinions welcome.
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]