Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 3096] Ability to annotate packet captures

Date: Mon, 13 Feb 2012 12:01:15 -0800 (PST)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3096

--- Comment #42 from Guy Harris <guy@xxxxxxxxxxxx> 2012-02-13 12:01:13 PST ---
Given that

    1) the pcap-NG spec currently doesn't say "only one comment per packet", so
people could already be writing out files with multiple comments per packet;

    2) the code would have to do *something* with multiple-comment-per-packet
files even if we ban them in the spec (even if it's just discarding all but the
first);

    3) some other file formats appear to support multiple comments per packet,
and I think NetMon, at least, really supports them in the UI (the old Observer
manual I have speaks of "[adding] a comment to a packet that hasn’t yet been
commented", so perhaps the application only supports one comment per packet,
even though "comment" is a TLV type in a TLV list, so the file format appears
to support multiple comments per packet);

I'd vote against banning multiple comments per packet in pcap-NG format.

NetMon's UI

   
http://blogs.technet.com/blogfiles/netmon/WindowsLiveWriter/Framecommentingishere_8B8A/clip_image002_2.jpg

appears to put the comments in an additional pane in the main window, with
"Next Comment" and "Previous Comment" buttons, along with "Edit" and "Delete"
buttons.

Another UI that came to mind would be to have a "View Comments" menu item that
pops up a window showing a list of comments, perhaps showing the first line of
each comment, in one pane, with another pane showing the currently selected
comment; it could have "Edit", "Add", and "Delete" buttons, and "Edit" could
either pop up another window or just make the current pane editable.

There are probably other possibilities.

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
You are watching all bug changes.