Wireshark-dev: Re: [Wireshark-dev] Some fields output nothing, when using tshark with -T fields
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Sake Blok <sake@xxxxxxxxxx>
Date: Tue, 22 Jan 2008 02:03:02 +0100
On Mon, Jan 21, 2008 at 10:07:22PM +0100, Nils wrote:
> I had a look at the patch [1], which introduced -T fields, especially
> at this file [2]. However I did not figure out why it outputs nothing
> for some fields. As far as I can see, all the fields added with -e are
> appended to the 'fields' struct within output_fields_add(..), but I
> can't see where it gets the values for the fields (guess: in
> proto_tree_get_node_field_values(..), but I don't understand this
> function so far)

Yes, the fields will be added to the fields struct, but when
proto_tree_get_node_field_values() goes through the fields, it
uses get_node_field_value() to get the actual value. This function
returned NULL when a fields was of type FT_NONE. I committed a
patch that makes it return "1" instead.

Could you check an automated build from:
http://www.wireshark.org/download/automated/

In a couple of hours you should see a version 24158 or higher that 
will contain the fix.

Cheers,
   Sake