ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] Display multiple frames (of multiple TCP segments) in COL_IN

From: Stephen Fisher <steve@xxxxxxxxxxxxxxxxxx>
Date: Thu, 29 Sep 2011 13:56:30 -0600
On Thu, Sep 29, 2011 at 09:33:02PM +0300, Kaul wrote:

> In the COL_INFO, I'll just see 'PDU 1'.

Without trying out your dissector, my first guess is that the column is 
no longer writable the next time you're trying to write to it.  You can 
check if it's writable before you write to it with the 
col_get_writable() function, i.e.:

  if(!col_get_writable(COL_INFO))
	  g_warning("Can't write to COL_INFO!"");

As you see, the col_set_str() quietly bails out if the column isn't 
writable:

>From epan/column-utils.c...

col_set_str(column_info *cinfo, const gint el, const gchar* str)
{
  int i;
  int fence;
  size_t max_len;

  DISSECTOR_ASSERT(str);

  /* The caller is expected to pass in something that 'will stay around' and
   * something from the ephemeral pool certainly doesn't fit the bill. */
  DISSECTOR_ASSERT(!ep_verify_pointer(str));

  if (!CHECK_COL(cinfo, el))
    return;

<snip>