Wireshark · Ethereal-dev: Re: [Ethereal-dev] How to colorize display from within the dissector

["Martin Regner" <martin.regner@xxxxxxxxx>]

 

S. Faizi wrote:

<I want to display a certain messages in red in the summary information.

 

You cannot colorize directly from a dissector, but you could use color filters that sets the color to e.g. red for a PDU

that contains a certain element or similar.

So if you want to indicate a certain error with a color, the dissector can be updated to put a field that can be used to filter on.

 

For example if I want to red-mark all SIP-messages sent over TCP where Content-Length header is missing I could

use a color filter:

sip and tcp and  !(sip.Content-Length)

 

If you want to red-mark all SIP-messages where Status-Code is greater than 500 you can use a color filter:

sip.Status-Code > 500

 

If I want to red-mark all SIP-messages that are marked as "Resent Packet" I can use acolor filter:

sip.resend != 0

 

If I want to to filter for TCP packets that are indicated as out-of-order by the TCP Analysis feature you can use a color filter:

tcp.analysis.out_of_order

 

 

See also Guy Harris answer:

http://www.ethereal.com/lists/ethereal-dev/200411/msg00247.html