Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 5380] Better decode for NetFlow NBAR applicationId

Date: Wed, 1 Dec 2010 10:11:03 -0800 (PST)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5380

Andrew Feren <acferen@xxxxxxxxx> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Attachment #5548|                            |review_for_checkin?
               Flag|                            |

--- Comment #2 from Andrew Feren <acferen@xxxxxxxxx> 2010-12-01 10:11:00 PST ---
Created an attachment (id=5548)
 --> (https://bugs.wireshark.org/bugzilla/attachment.cgi?id=5548)
simple patch for better nbar application id display

Attached patch displays all 4 bytes (type and ID) in a readable way.  Also
allows better filtering.

I did notice one odd thing that I think is a bug elsewhere in wireshark, but
maybe I did something wrong in my patch.

entering a display filter with an integer like this "cflow.appl_id ==
100663546"

works fine.

Trying to enter a hex value like this "cflow.appl_id == 0x060000fa" crashes as
soon as I type the 'x'.

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.