Wireshark-dev: Re: [Wireshark-dev] colorizing sFlow
From: Joerg Mayer <[email protected]>
Date: Mon, 15 Oct 2007 23:51:21 +0200
On Mon, Oct 15, 2007 at 11:21:23PM +0200, Ulf Lamping wrote:
> Not generally, but my feeling is that having lot's of exceptions to the 
> coloring rules is not the way to go here. The problem here is that the 
> TCP/UDP dissectors missinterprete stuff - and that should be fixed 
> instead IMHO.
> In the end having a set of coloring rules that someone can understand is 
> a value in itself IMHO.

IMO we need something like a protocol-as-payload flag to set at
some point into the dissection: It should have several meanings:
a) From now on dissection may break at any time and it's not an error
b) Don't update the info column any more
c) not relevant to filters (or just color-filters?)

Does this make any sense? Would it be doable?

Joerg Mayer                                           <[email protected]>
We are stuck with technology when what we really want is just stuff that
works. Some say that should read Microsoft instead of technology.