Ethereal-dev: Re: [Ethereal-dev] Searching for packets with incorrect checksums

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Gilbert Ramirez <gram@xxxxxxxxxxxxxxx>
Date: Tue, 18 Dec 2001 13:14:04 -0600
On Tue, 18 Dec 2001 12:54:48 Guy Harris wrote:
> 
> The same way the IP dissector does it:
> 
>     if (ipsum == 0) {
> 	proto_tree_add_uint_format(ip_tree, hf_ip_checksum, tvb,
> 		offset + 10, 2, iph.ip_sum,
> 		"Header checksum: 0x%04x (correct)", iph.ip_sum);
>     }
>     else {
> 	proto_tree_add_item_hidden(ip_tree, hf_ip_checksum_bad, tvb,
> 		offset + 10, 2, TRUE);
> 	proto_tree_add_uint_format(ip_tree, hf_ip_checksum, tvb,
> 		offset + 10, 2, iph.ip_sum,
> 		"Header checksum: 0x%04x (incorrect, should be 0x%04x)",
> 		iph.ip_sum, in_cksum_shouldbe(iph.ip_sum, ipsum));
>     }

I don't like this use of hidden fields. Yes, the hf_ip_checksum_bad
field is not part of the packet, but it should still be shown in the
GUI protocol tree, so that users know that it exists and can be used
in a filter expression.

--gilbert