Wireshark · Wireshark-dev: [Wireshark-dev] Checksum filterable fields

[mmann78@xxxxxxxxxxxx]

Bug 8858 (https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=8858) reminded me of something I noticed when trying to apply the new filterable expert info API - there isn't a consistency among dissectors to note a good or bad checksum.

 

I've seen

1. Checksum field (no verification)

2. Checksum field + append_text with good/bad (or only bad)

3a. Checksum field + "bad" field filter (field is treated as "present")

3b. Checksum field + "bad" field filter (field is boolean, so good can be separated from bad)

4. Checksum field + "bad" field filter + expert_info

5. Checksum field + "bad" field filter + "good" field filter

6. Checksum field + "bad" field filter + "good" field filter + expert_info

 

The ones that really seem excessive are 5 & 6 - do we really need this duplication? <dissector>.bad_checksum = TRUE equals <dissector>.good_checksum = FALSE.  Could we consolidate all (that have checksum verification) to

 

Checksum field + "good" boolean field filter (of the form <dissector>.good_checksum) + expert_info for bad checksum (of the form <dissector>.bad_checksum)

 

 

Opinions welcome.