We're now a non-profit! Support open source packet analysis by making a donation.

Ethereal-dev: Re: [Ethereal-dev] Color-filter feature with text in Info-column

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: SEKINE Hideki <[email protected]>
Date: Fri, 30 Jul 2004 10:54:45 +0900
Hi Martin,

I'm new to this list. I also found filter function useful.
Because most fields support filter name, it seems feasible
to make ethereal generate any .csv file.

In my idea, the follwing single-line csv is specifid as a format.
 frame.pkt_len, ip.srcport, ip.destport, ... (using filter name)

Ethereal then output in the format specified.

Martin Regner wrote:

I have reently started to use color filter more than before (they are really useful)
and I have been thinking of an enhancement.

Sometimes I have had a lot of color filters for different PDU types and I have to have a table to see what light-blue really means.
I'm also switching between my own computer and computers in the lab where other
people are defining their own color filters.

It could be good to be able to specify a string (or maybe use the color-filter name) that will appear somewhere in the Info-column
so that you can see why the packet is colored.

This way it would be possible to add useful information to the Info-column without having to change the Ethereal source code.
I'm not sure exactly how it should look, but maybe we could have the filtername 
in braces in the beginning or end of the Info-column:
{UDP-Broadcast-filter}  Source port: 4799   Destination port: 7887  
Source port: 4199   Destination port: 7880  
{SNMP-Trap-My-Application-rebooted} SNMP-TRAP
{UDP-Broadcast-filter} MyOwnProtocol PDUtype=71 
{UDP-Broadcast-filter}  Source port: 7122   Destination port: 9111
{RAD-Acct-Start}  RADIUS Accounting Request(4) (id=0, l=573)
{RAD-Acct-Stop}  RADIUS Accounting Request(4) (id=0, l=176)

I was thinking that only the first matching color filter should be used (as already done for coloring), but if you define your color filters in a clever way that would maybe not be an important limitation.
The behaviour should be configurable in some way. 
The name/text should only appear in the Info column if you want it to appear.
If you haven't defined a name for the color filter nothing should appear either.

Actually this also means that color-filters could be useful with tethereal/text-printouts in the future. But maybe there should be a separate configure
setting whether to do that.

I haven't started to look how to implement this and it will probably take a couple of weeks until I can start with looking at the details, but I wanted to know your viewpoints before I start with it.
Ethereal-dev mailing list
[email protected]