Wireshark · Ethereal-dev: Re: [Ethereal-dev] col_clear for multiple messages in one packet

[Guy Harris <gharris@xxxxxxxxx>]

Jacques, Olivier (OCBU-Test Infra) wrote:

> But this seems like a common problem: is there a better - more generic -
> solution?

There's currently no generic solution.

The *ideal* solution might be one where, instead of each new protocol 
layer overwrote the Info column, each protocol layer had its own Info 
layer to use, which starts out empty, so that they don't need to clear 
the Info layer.

This would also, in theory, allow us to have some mechanism for showing 
all the Info layers for a given packet, although the main questions that 
raises are what the UI should be.  Should the packet list become a tree 
view, so that you can open up the view for an individual packet, with 
all the layers shown below what presumably would be the topmost layer? 
Should there be an "open all" option?

One problem with that is that I think some protocols expect the next 
protocol down to *add* information to their Info column rather than 
*overwriting* it.

If we did that, we'd probably also want stacks of addresses, protocol 
identifiers, etc. so that *all* columns are shown if you open up the 
display for a packet.  There are some other reasons why such a stack 
might be useful, e.g. the capture-filter-like "host" operation, which 
would, without a qualifier, match link-layer and network-layer addresses.

That doesn't handle the case where you have, for example, protocol X, 
running atop TCP, with protocol Y running atop protocol X, with multiple 
protocol-X packets, each containing a protocol-Y packet, in a TCP segment.