Wireshark-bugs: [Wireshark-bugs] [Bug 12958] Wrong JSON format returned by new -T json feature
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Thu, 29 Sep 2016 15:09:55 +0000

Comment # 3 on bug 12958 from 
If I understood it correctly all the cases are related to duplicated key in
json output. RFC specification seems not be very clear about the duplicated
keys. So it depends on the implementation of the json parser.

Currently tshark output copy the structure of pdml output. 

1. ip.addr and tcp.port issue
I think we can ignore fields in json if they contain hide="yes" in pdml. =>
This could fix the ip.addr and tcp.port issue and reduce the json size.

2. 104apci issue
The 104apci layer seems to be included multiple times and it is in this way
also interpreted in Wireshark GUI. Therefor I think the duplicated key is
required in this case. To group it together into some array and we would need
this information from dissectors. But correct me if I'm wrong or you see some
better solution.

You are receiving this mail because:
  • You are watching all bug changes.