Wireshark · Ethereal-dev: Re: [Ethereal-dev] BUG in "Export as PSML" and "as CSV"

[Stefano Pettini <spettini@xxxxxxxxxxxxxxxxxxxxx>]

Guy Harris wrote:

> What if there's more than one instance of one of those fields (e.g.,
>  some form of tunneling with two IP layers)?

Boh! I don't know :-)

> Should it always pick the first one or the last one, or have an
> option to control which one to pick?

I think it's better to export the first one (if you have a mix of simple 
IP packets and encapsulated IP packet, the output is coherent only if 
the exported fields come from the same IP instance).

> (Some fields can have more than
> one instance in a *single* packet; that one's harder to handle.)

I don't know. There's even another problem: not all packets belong to 
the same protocol, so it's possible to have fields (like tcp.port) not 
available in all packets (udp).

I suggest to export the first field of the first packet instance, if 
available, or a NULL value, as "" in CSV, if it's not.

Ciao
Stefano