Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 3096] Ability to annotate packet captures

Date: Thu, 9 Feb 2012 07:03:56 -0800 (PST)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3096

--- Comment #21 from Martin Kaiser <wireshark@xxxxxxxxx> 2012-02-09 07:03:55 PST ---

Hi Anders,

> Would it make more sense to pass the whole struct wtapng_packet_t to
> "wth"

I tried to come up with something generic and just add the comment. I
understand that apart from pcapng, there's at least one other file format that
supports comments.

Do you think that the other components of wtapng_packet_t are generally useful
and not pcapng-specific?

> and store the comment in fdata,

I tried that and got a feedback from Guy that I should avoid adding components
to frame_data. The reason seems to be that only very few packets will have a
comment attached but the additional entry in struct frame_data would waste
memory for each packet.

> then display it after Frame in the protocol tree? 

That sounds good, we could then filter for all packets that have a comment. Is
it possible to display UTF-8 characters in the protocol tree?

I'll try adding updating my patch to add the comments to the protocol tree.

> It might then be possible to make that cell editable
> and actually be able to anotate packets.

Is this related to the packet editor (configure --enable-packet-editor) ? 

Regards,

   Martin

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
You are watching all bug changes.