First time here? Check out the FAQ!
THIS IS A TEST INSTANCE. Feel free to ask and answer questions, but take care to avoid triggering too many notifications.
0

Custom Columns Fields limit?

  • retag add tags

Hello,

Is there a limit to the custom columns fields that can be specified, be it in number of fields or total number of characters of the "Fields" string?

For example, I have a custom column with the following definition on the preferences file and it works fine.

"PDN Address IPv4", "%Cus:gtp.user_ipv4 || gtp.pdp_address.ipv4 || gtpv2.pdn_addr_and_prefix.ipv4 || radius.Framed-IP-Address || diameter.Framed-IP-Address.IPv4 || diameter.PDP-Address.IPv4 || gprscdr.iPBinV4Address || diameter.UE-Local-IP-Address.IPv4:0:R",

When I add a new field via the GUI, e.g. pfcp.ue_ip_addr_ipv4, it works ok and the custom column immediately reflects the change, but when I close and reopen Wireshark all my columns are gone like if Wireshark could not read my preferences and after a bit of troubleshooting I realized that the big column below was to blame and as soon as I commented it or removed the last added field Wireshark could load all my columns again just fine.

"PDN Address IPv4", "%Cus:gtp.user_ipv4 || gtp.pdp_address.ipv4 || gtpv2.pdn_addr_and_prefix.ipv4 || radius.Framed-IP-Address || diameter.Framed-IP-Address.IPv4 || diameter.PDP-Address.IPv4 || gprscdr.iPBinV4Address || diameter.UE-Local-IP-Address.IPv4 || pfcp.ue_ip_addr_ipv4:0:R",

So I understand there is some kind of limit, so is it by number of fields or by total size of the custom column string definition?

Regardless of the type of limit, would it be possible to increase it? I analyse traces with many protocols with different fields for the same thing, like PDN Address in my example, so it would be great if I could continue using single custom columns for all the fields...

Moreover, when I add the new field on the Columns Preferences GUI there is no error, so given that there is a limit it would be good that the GUI could reflect it and warn about it or return an error if the limit was exceeded.

Thank you so much in advance for the feedback and support.

Kind regards, Hax.

Haxthausen's avatar
5
Haxthausen
asked 2020-09-14 02:16:38 +0000
edit flag offensive 0 remove flag close merge delete

Comments

add a comment see more comments

1 Answer

0

It's limited to COL_MAX_LEN in column-info.h:

#define COL_MAX_LEN 256

For testing I bumped it out to 400 and was able to save and read back in your longer column defintion.

A similar question with a link to old answer to recompile.

There probably should be data validation all the way around - data entry, save to preferences file and verifying when reading the preferences back in.

Chuckc's avatar
3k
Chuckc
answered 2020-09-14 05:12:51 +0000
edit flag offensive 0 remove flag delete link

Comments

Thank you for the feedback. I would prefer not having to recompile Wireshark myself. :D I understand then that there's room for improvement so I'll open a bug for that. Thanks!

Haxthausen's avatar Haxthausen (2020-09-17 19:44:07 +0000) edit

Following issue submitted.

Custom Columns Fields limit (#16905) · Issues · Wireshark Foundation / wireshark · GitLab https://gitlab.com/wireshark/wireshar...

Haxthausen's avatar Haxthausen (2020-10-12 18:50:45 +0000) edit
add a comment see more comments

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account. This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.

Add Answer