Wireshark · Ethereal-dev: Re: [Ethereal-dev] Is the hiding of protocol fields (e.g. bad checksum) in general a good idea?

[Jaap Keuter <jaap.keuter@xxxxxxxxx>]

Well it's not a part of the real packet data, is it?

So, littering the packet display with all kinds of analytical data  about
the health of the packet is just not a good idea.

Greetz,
Jaap

On Fri, 8 Jul 2005, Ulf Lamping wrote:

>
> Hi List!
>
> I'm currently looking at the checksum protocol fields. For example, the TCP checksum will usually look like:
> Checksum: 0x5424 [correct]
> and if it's bad:
> Checksum: 0x5424 [incorrect, should be 0x1234]
> In this case, a hidden boolean field is added to be able to filter on this item (e.g. to see only "bad checksummed" packets).
> Question: Why do we hide this field at all?
> I don't see any good reason to hide this (and alike) fields. If someone wants to use it, he must *know* that it's available and must *know* it's name. This doesn't seem to be very intuitive.
> Is there any reason I'm too blind to see?
> IMO this field should be visible and marked as generated, so it will look like: [Bad Checksum: True]
>
> Regards, ULFL
>
> P.S: The same *may* apply to most (all?) other hidden fields as well?!?