Ask Your Question
0

Custom Columns Fields limit?

asked 2020-09-14 02:16:38 +0000

Haxthausen gravatar image

Hello,

Is there a limit to the custom columns fields that can be specified, be it in number of fields or total number of characters of the "Fields" string?

For example, I have a custom column with the following definition on the preferences file and it works fine.

"PDN Address IPv4", "%Cus:gtp.user_ipv4 || gtp.pdp_address.ipv4 || gtpv2.pdn_addr_and_prefix.ipv4 || radius.Framed-IP-Address || diameter.Framed-IP-Address.IPv4 || diameter.PDP-Address.IPv4 || gprscdr.iPBinV4Address || diameter.UE-Local-IP-Address.IPv4:0:R",

When I add a new field via the GUI, e.g. pfcp.ue_ip_addr_ipv4, it works ok and the custom column immediately reflects the change, but when I close and reopen Wireshark all my columns are gone like if Wireshark could not read my preferences and after a bit of troubleshooting I realized that the big column below was to blame and as soon as I commented it or removed the last added field Wireshark could load all my columns again just fine.

"PDN Address IPv4", "%Cus:gtp.user_ipv4 || gtp.pdp_address.ipv4 || gtpv2.pdn_addr_and_prefix.ipv4 || radius.Framed-IP-Address || diameter.Framed-IP-Address.IPv4 || diameter.PDP-Address.IPv4 || gprscdr.iPBinV4Address || diameter.UE-Local-IP-Address.IPv4 || pfcp.ue_ip_addr_ipv4:0:R",

So I understand there is some kind of limit, so is it by number of fields or by total size of the custom column string definition?

Regardless of the type of limit, would it be possible to increase it? I analyse traces with many protocols with different fields for the same thing, like PDN Address in my example, so it would be great if I could continue using single custom columns for all the fields...

Moreover, when I add the new field on the Columns Preferences GUI there is no error, so given that there is a limit it would be good that the GUI could reflect it and warn about it or return an error if the limit was exceeded.

Thank you so much in advance for the feedback and support.

Kind regards, Hax.

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2020-09-14 05:12:51 +0000

Chuckc gravatar image

It's limited to COL_MAX_LEN in column-info.h:

#define COL_MAX_LEN 256

For testing I bumped it out to 400 and was able to save and read back in your longer column defintion.

A similar question with a link to old answer to recompile.

There probably should be data validation all the way around - data entry, save to preferences file and verifying when reading the preferences back in.

edit flag offensive delete link more

Comments

Thank you for the feedback. I would prefer not having to recompile Wireshark myself. :D I understand then that there's room for improvement so I'll open a bug for that. Thanks!

Haxthausen gravatar imageHaxthausen ( 2020-09-17 19:44:07 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2020-09-14 02:16:38 +0000

Seen: 25 times

Last updated: Sep 14