Yes - that is a good example with tftp and makes sense.
But then, not to pick on tftp, are two filename fields needed?
There is no file rename in the protocol so it's the same file on both ends.
The write example only has a destination file.
Tangent question:
The numeric tftp opcode has "name resolution" done to a string description:
(tftp.opcode) Opcode: Read Request (1)
SMTP does the same thing:
(smtp.response.code) Response code: Requested mail action okay, completed (250)
But http breaks it into two fields:
(http.response.code) Status Code: 302
(http.response.code.desc) [Status Code Description: Found]
Is this a "it depends" where sometimes it's "shall" and other it's "should"?
If I add tftp.opcode as a column in the GUI, the text translation is displayed.
Query with tshark and it's the numeric value:
Downloads$ tshark -r ./tftp_wrq.pcap -T fields -e tftp.opcode | head -5
2
4
3
4
3
People (myself at the top of the list) are good at opening issues if it's a problem but I learn a lot from these style discussions.
Thanks!
chuckc
