Wireshark mailing list archives
Re: Indicate [Generated] field on Display Filter Reference page
From: John Thacker <johnthacker () gmail com>
Date: Sat, 14 Nov 2020 17:42:13 -0500
On Sat, Nov 14, 2020, 4:14 PM Guy Harris <gharris () sonic net> wrote:
I.e., "generated" is a property of an instance of a field, not of a field; that's why the code sample you showed has a separate call to proto_item_set_generated(). That may not be the case for *all* fields that have generated instances, but there might be some fields that have both generated and non-generated instances.
For an example, take a look at packet-tftp.c TFTP packets with the read request and write request opcodes contain a source or destination filename, respectively, and in those packets the corresponding fields are added without set_generated() For packets with other opcodes, conversation tracking is used to add the source or destination filename, as appropriate, for the ongoing transfer, and there set_generated() is used because it's not actually in those packets. John Thacker
___________________________________________________________________________ Sent via: Wireshark-dev mailing list <wireshark-dev () wireshark org> Archives: https://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev mailto:wireshark-dev-request () wireshark org?subject=unsubscribe
Current thread:
- Indicate [Generated] field on Display Filter Reference page chuck c (Nov 14)
- Re: Indicate [Generated] field on Display Filter Reference page Guy Harris (Nov 14)
- Re: Indicate [Generated] field on Display Filter Reference page chuck c (Nov 14)
- Re: Indicate [Generated] field on Display Filter Reference page John Thacker (Nov 14)
- Re: Indicate [Generated] field on Display Filter Reference page chuck c (Nov 14)
- Re: Indicate [Generated] field on Display Filter Reference page Guy Harris (Nov 14)