2008/3/5, Stephen Fisher <[EMAIL PROTECTED]>: > On Wed, Mar 05, 2008 at 08:34:10PM +0100, Stig Bjørlykke wrote: > > > We already have the cumulative number of bytes in the frame dissector > > (used for the cumulative column), so it's just a matter of adding this > > as a generated frame field. > > Do we? The Cumulative Bytes column is pulled out of > pinfo->fd->cum_bytes.
My text should probably be: "in the frame_data struct" :) But it's easy to add this as a generated frame field. > Hmm.. what would frame.cum_len > 1000 do wrong? I guess it depends on if > it's cumulative from the beginning of the capture or for displayed > packets. That could get messy. The cumulative bytes in the frame_data struct is for displayed packets, which would never be greater than 0 when using this as filter... If this should work I suppose we should add yet another cumulative bytes counter. -- Stig Bjørlykke _______________________________________________ Wireshark-users mailing list Wireshark-users@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-users
