Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Packet display columns enhancement

From: Sake Blok <sake@xxxxxxxxxx>
Date: Sat, 22 Dec 2007 18:33:50 +0100
On Sat, Dec 22, 2007 at 10:22:36AM -0700, Stephen Fisher wrote:
> On Sat, Dec 22, 2007 at 12:00:12PM -0500, Frank Solensky wrote:
> 
> > What I'd like to do is to rework the code in the "Edit > Preferences >
> > User Interface > Columns" options so that the user could add or remove
> > packet list pane columns beyond those currently offered.  This would
> > be based off the same tree generated for the "Display Filter >
> > Expression > Field Name" dialog.
> > 
> > I haven't seen any mention of anything like this in bugzilla or in the
> > mailing list archives yet but my search has only been cursory so far.
> > Is this something that's already been though of?  If not, is it
> > something that others would fine useful as well?
> 
> Enhancement Bug #2002 is titled "Add ability to make any field a column"
> 
>   http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2002
> 
> I am very interested in getting this implemented as well, but have not
> had the time to do it yet.  I was thinking that this could be
> implemented using the proto_tree_add_* functions.  Those functions would
> check if a column with the contents of the field being processed is
> active and if so, populate it.  I am not sure how much of a performance
> hit we would take doing this though.

Isn't it possible to have a routine appended at the end of the packet
processing that looks for columns with a field-name and then look up the
corresponding value. That would be less of a performance hit I think.

I too would find this flexibility very useful :-)

Cheers,
    Sake