Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Ethereal-dev: [Ethereal-dev] Re: Is the hiding of protocol fields (e.g. bad checksum) in gener

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: ronnie sahlberg <ronniesahlberg@xxxxxxxxx>
Date: Fri, 8 Jul 2005 17:39:08 -0400
I agree 100%

In my view we should never use hidden fields.

There is in my opinion a very good practical and useability reason for
not using hidden fields:
There are now so many fields managed by Ethereal so it is just not
ptractical to go look in the list-of-fields list.
Therefore the only way to find out about fields are by looking at
where they are used in the decode pane.

So I would suggest something like this for the checksum field :

Make Checksum an expansion
 -  Checksum 0x1234 (correct)
       [boolean flag field]

Let the boolean field under checksum be a GENERATED field and let it
be one out of these four :
   tcp.checksum.good  [TCP Checksum is good]
   tcp.checksum.bad  [TCP Checksum is wrong]
   tcp.checksum.disabled  [TCP checksum checking is disabled in
preferences and not checked]
   tcp.checksum.short_packet  [TCP checksum is not checked since the
packet is short]


In the same way I think IP SRV and IP DST should be an expansion and show
the hidden field   ip.addr   as a generated field inside that expansion.



This makes it possible to see and learn about these useful fields by
just looking at real packets in the decode pane.


On 7/8/05, Ulf Lamping <ulf.lamping@xxxxxx> wrote:
> 
> Hi List!
> 
> I'm currently looking at the checksum protocol fields. For example, the TCP
> checksum will usually look like:
> 
> Checksum: 0x5424 [correct]
> 
> and if it's bad:
> 
> Checksum: 0x5424 [incorrect, should be 0x1234]
> 
> In this case, a hidden boolean field is added to be able to filter on this
> item (e.g. to see only "bad checksummed" packets).
> 
> Question: Why do we hide this field at all?
> 
> I don't see any good reason to hide this (and alike) fields. If someone
> wants to use it, he must *know* that it's available and must *know* it's
> name. This doesn't seem to be very intuitive.
> 
> Is there any reason I'm too blind to see? 
> 
> IMO this field should be visible and marked as generated, so it will look
> like: [Bad Checksum: True]
> 
> Regards, ULFL
> 
> P.S: The same *may* apply to most (all?) other hidden fields as well?!?
> _________________________________________________________________________
> Mit der Gruppen-SMS von WEB.DE FreeMail können Sie eine SMS an alle 
> Freunde gleichzeitig schicken: http://freemail.web.de/features/?mc=021179
> 
> 
> 
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev
>