ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] proto.h extension

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Fri, 8 May 2015 12:30:13 -0700
On May 8, 2015, at 12:13 PM, Evan Huus <eapache@xxxxxxxxx> wrote:

> It would be simpler and smarter if we just accounted for the fact when
> aligning fields: if a field does not have a bitmask, but something
> above/below it (in the same tree) does then indent it with the
> appropriate number of spaces.

Presumably "something" means "a separate field occupying different bytes", so we don't, for example, get the top-level item for a MAC address indented to the same extent as its locally-vs-globally-administered and individual-vs-group bits.

That would produce output such as

Internet Protocol Version 4, Src: 10.120.4.1 (10.120.4.1), Dst: 224.0.0.5 (224.0.0.5)
    0100 .... = Version: 4
    .... 0101 = Header Length: 20 bytes
                Differentiated Services Field: 0xc0 (DSCP 0x30: Class Selector 6; ECN: 0x00: Not-ECT (Not ECN-Capable Transport))
                    1100 00.. = Differentiated Services Codepoint: Class Selector 6 (0x30)
                    .... ..00 = Explicit Congestion Notification: Not-ECT (Not ECN-Capable Transport) (0x00)
                Total Length: 64
                Identification: 0x2571 (9585)
                Flags: 0x02 (Don't Fragment)
                    0... .... = Reserved bit: Not set
                    .1.. .... = Don't fragment: Set
                    ..0. .... = More fragments: Not set
                Fragment offset: 0
                Time to live: 1
                Protocol: OSPF IGP (89)
                Header checksum: 0x64b6 [validation disabled]
                    [Good: False]
                    [Bad: False]
                Source: 10.120.4.1 (10.120.4.1)
                Destination: 224.0.0.5 (224.0.0.5)
                [Source GeoIP: Unknown]
                [Destination GeoIP: Unknown]

Is that what we want?