Hello,
Is there a limit to the custom columns fields that can be specified, be it in number of fields or total number of characters of the "Fields" string?
For example, I have a custom column with the following definition on the preferences file and it works fine.
"PDN Address IPv4", "%Cus:gtp.user_ipv4 || gtp.pdp_address.ipv4 || gtpv2.pdn_addr_and_prefix.ipv4 || radius.Framed-IP-Address || diameter.Framed-IP-Address.IPv4 || diameter.PDP-Address.IPv4 || gprscdr.iPBinV4Address || diameter.UE-Local-IP-Address.IPv4:0:R",
When I add a new field via the GUI, e.g. pfcp.ue_ip_addr_ipv4, it works ok and the custom column immediately reflects the change, but when I close and reopen Wireshark all my columns are gone like if Wireshark could not read my preferences and after a bit of troubleshooting I realized that the big column below was to blame and as soon as I commented it or removed the last added field Wireshark could load all my columns again just fine.
"PDN Address IPv4", "%Cus:gtp.user_ipv4 || gtp.pdp_address.ipv4 || gtpv2.pdn_addr_and_prefix.ipv4 || radius.Framed-IP-Address || diameter.Framed-IP-Address.IPv4 || diameter.PDP-Address.IPv4 || gprscdr.iPBinV4Address || diameter.UE-Local-IP-Address.IPv4 || pfcp.ue_ip_addr_ipv4:0:R",
So I understand there is some kind of limit, so is it by number of fields or by total size of the custom column string definition?
Regardless of the type of limit, would it be possible to increase it? I analyse traces with many protocols with different fields for the same thing, like PDN Address in my example, so it would be great if I could continue using single custom columns for all the fields...
Moreover, when I add the new field on the Columns Preferences GUI there is no error, so given that there is a limit it would be good that the GUI could reflect it and warn about it or return an error if the limit was exceeded.
Thank you so much in advance for the feedback and support.
Kind regards, Hax.