Ask Your Question
0

Tshark: Error loading table 'Expert Info Severity Level Configuration'

asked 2022-10-19 09:55:26 +0000

StefanB gravatar image

Hi,

No matter what version I use (3.2, 3.4.1, 3.6.8), I always get the error message

tshark: Error loading table 'Expert Info Severity Level Configuration': Expert Info field doesn't exist

when running tshark.

OS: Windows 10

The problem seems to come from the expert_packet_init function, but I am not able to pin it down.

Does someone know, what is causing this error message?

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
1

answered 2022-10-19 13:47:06 +0000

Chuckc gravatar image

This comes from (expert.c):

    if (expert_registrar_get_byname(rec->field) == NULL) {
        *err = ws_strdup_printf("Expert Info field doesn't exist");
        return FALSE;
    }


The expert severity configuration is stored in the profile directory in a file named expert_severity.
There must be a field referenced in there that changed names or doesn't exist any longer.
You can update the UAT entries by editing/removing the file or in the Wireshark gui.

In this example I modified the field name isis.lsp.short_clv to one that does not exist to recreate the error.

# This file is automatically generated, DO NOT MODIFY.
"foo_isis.lsp.short_clv","Note

image description image description

edit flag offensive delete link more

Comments

It would be helpful if the error message included the field name causing the issue.
Might be worth opening an issue at https://gitlab.com/wireshark/wireshar... .

Done: 8582: expert UAT: display field name on load error

Chuckc gravatar imageChuckc ( 2022-10-19 13:52:59 +0000 )edit

Thanks Chuck, that was exactly my issue. Just so I understand correctly, the expert_severity file is used to override the hardcoded severity of expert infos?

StefanB gravatar imageStefanB ( 2022-10-20 07:40:16 +0000 )edit

10180: Allow severity levels of expert info items to be configured by the user

"Would it be possible to add the capability for the user to modify the Expert? It would be nice to be able to modify which situations would fall under certain severity levels. If we would be able to save those settings to our profiles as well I feel this would greatly benefit many users of Wireshark. Thank you!"

commit/507d07ed
"UAT was the easiest way to do this and I like the "file format" of the data, but the presentation doesn't seem that great."

Yes. And depending on when the config was set, it's possible to see a different error on load after this change:
6105: Expert info: "Ok" is not valid severity level

Chuckc gravatar imageChuckc ( 2022-10-20 13:05:26 +0000 )edit

That's great, thanks a lot!

StefanB gravatar imageStefanB ( 2022-10-21 13:41:04 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

Stats

Asked: 2022-10-19 09:55:26 +0000

Seen: 216 times

Last updated: Oct 19 '22