On Dec 25, 2019, at 10:44 AM, Maynard, Chris <christopher.mayn...@igt.com> wrote:
> Or revert this change so whois.answer reflects the entire answer again, but > add each line underneath the answer using a different filter, such as > "whois.answer.line"? We could, but I think going back to the way it was before would be a bad idea. > I would prefer this solution as the answer is the entire answer and each line > is only part of the answer. The argument could be made for other text protocols. The problem is that "the entire answer" is hard to read. > For example: > V WHOIS: Answer > V Answer [truncated]: % IANA WHOIS server\n% for more information > on IANA, visit http://www.iana.org\n% This query returned 1 object\n\n > domain: EXAMPLE.COM\n\norganisation: Internet Assigned Numbers > Authority\n\n created: 1992-01- Note the word "truncated" here. That's not a good thing. > Line 1: % IANA WHOIS server\n > Line 2: % for more information on IANA, visit > http://www.iana.org\n > Line 3: % This query returned 1 object\n > Line 4: \n > Line 5: domain: EXAMPLE.COM\n > Line 6: \n > Line 7: organisation: Internet Assigned Numbers Authority\n > Line 8: \n > Line 9: created: 1992-01-01\n > Line 10: source: IANA\n > Line 11: \n Something that displays it in *that* fashion, with each line shown underneath an item for the entire {WHOIS answer, SMTP mail message, HTTP/SIP/etc. header, HTTP text payload, etc.}, might be the right way to handle text protocols. And, given that, is there any need to show the full text in the top-level item? ___________________________________________________________________________ Sent via: Wireshark-dev mailing list <wireshark-dev@wireshark.org> Archives: https://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev mailto:wireshark-dev-requ...@wireshark.org?subject=unsubscribe
