Wireshark · Ethereal-users: [Ethereal-users] tethereal column format & -z proto, colinfo incompatibility/bug/error?

["zze-CASTLEFORD David FTRD/RTA/LAN" <david.castleford@xxxxxxxxxxxxxxxxxxxx>]

Title: tethereal column format & -z proto,colinfo incompatibility/bug/error?

Hi,

I'm using tethereal to capture traffic and have specified the column display parameters using

        tethereal -o "column.format: time,%t,length,%L,protocol,%p, MACsrc,%uhs,MACdst,%uhd,IPsrc,%s,IPdst,%d etc.

This works fine and the displayed data is in the correct format.

However, I also need to access other protocol information that is not available via the column format.

I hoped to use the -z proto,colinfo,filter,field option  to add the parameters

Eg      tethereal -z proto,colinfo,udp.checksum_bad,udp.checksum_bad or
                "      "                "  tcp.analysis.ack_rtt,tcp.analysis.ack_rtt

Or whatever other field I want displayed.

This works fine so that I see the field displayed as eg udp.checksum_bad == 1
but only for the default ethereal column format….

If I specify different columns either with the -o option in tethereal or by changing the column preferences in ethereal and try using

        -z proto,colinfo,filter,field    I get the following error message:

** ERROR **:file columns-utils.c: line 274: assertion failed: (cinfo->col_first[el] >=0)
Aborting…

Using Windows 2000 Prof and Windows XP Prof with Ethereal 0.10.3 gives exactly the same error message.

Is this a bug? Is there any way I can use the following command successfully?:

        tethereal -o "column.format:…………." -z proto,colinfo,….,…..   -z proto,colinfo

Thanks,

David