Wireshark · Wireshark-dev: [Wireshark-dev] What severity should be shown for multiple expert infos in a packet ?

[Michael Lum <michael.lum@xxxxxxxxxxxxxxxxx>]

I searched and couldn't find anything on multiple expert infos.

 

What severity level is supposed to be shown in the 'expert' column
when there is more than one expert info in a packet?

 

This

 

An optional "Expert Info Severity" packet list column is available (since SVN 22387 → 0.99.7), that displays the most significant severity of a packet, or stays empty if everything seems ok.

 

at the bottom of section 7.3.4 "Expert" Packet List Column (optional)   http://www.wireshark.org/docs/wsug_html_chunked/ChAdvExpert.html

seems to imply an ERROR would be shown instead of WARN.

 

For example in one packet I have:

 

there was a UDP ERROR severity expert info for a bogus payload length

 

there was also a WARN severity expert info for a protocol dissected in
the UDP payload.

 

The 'expert' column displayed WARN.

 

It seems like a bug.

 

Michael Lum (michael.lum@xxxxxxxxxxxxxxxxx) | STAR SOLUTIONS | Principal Software Engineer

4600 Jacombs Road, Richmond BC, Canada V6V 3B1 | +1.604.303.2315