My perl script (and the former Excel trick) uses output from "(t)ethereal
-G". The -G switch does not appear in the Ethereal manpage however, so I
don't really know :( However, "hidden" fields such as 'tcp.checksum_bad'
appear in the list, so I expect all registered fields will be presented in
the tables.
When a proto_tree_add_text() or similar call is used, then some output will
be generated in Ethereal but no field is associated with it. This type of
output is not attached to an header field (hf_xyzzy) so it won't appear in
the "-G" list. This includes e.g., HTTP header names.
NOTE: In the case where one protocol field has more than one possible field
type (FT_XXX) definition, Ethereal will only list the 1st definition in the
"-G" output.
To summarize: (I suppose) all *filterable* fields are listed with "-G".
Regards,
Olivier
> -----Original Message-----
> From: John McDermott [mailto:jjm@jkintl.com]
>
> In reality, thought, is it "all...fields" or just all
> filterable fields?
> (I may be mistaken, but I thought there were some that were
> displayed, but not filterable.)
-G". The -G switch does not appear in the Ethereal manpage however, so I
don't really know :( However, "hidden" fields such as 'tcp.checksum_bad'
appear in the list, so I expect all registered fields will be presented in
the tables.
When a proto_tree_add_text() or similar call is used, then some output will
be generated in Ethereal but no field is associated with it. This type of
output is not attached to an header field (hf_xyzzy) so it won't appear in
the "-G" list. This includes e.g., HTTP header names.
NOTE: In the case where one protocol field has more than one possible field
type (FT_XXX) definition, Ethereal will only list the 1st definition in the
"-G" output.
To summarize: (I suppose) all *filterable* fields are listed with "-G".
Regards,
Olivier
> -----Original Message-----
> From: John McDermott [mailto:jjm@jkintl.com]
>
> In reality, thought, is it "all...fields" or just all
> filterable fields?
> (I may be mistaken, but I thought there were some that were
> displayed, but not filterable.)