Wireshark mailing list archives
displaying header field without filtering capability
From: "John Dill" <John.Dill () greenfieldeng com>
Date: Wed, 19 Feb 2014 16:17:14 -0500
I'm trying to add a header field for spare bytes in a custom dissector. Currently, I'm creating a header field for a 'Spare' data element in a 'Status' message, as shown in the example below: \code snippet { &hf_Spare, { "Spare", "msg.Status.Spare", FT_UINT8, BASE_HEX, NULL, 0x0, "Spare", HFILL } }, \endcode Later I have a function that processes the 'Status' message components. void dissect_message_Status(tvbuff_t* tvb, gint offset, proto_tree *tree) { proto_tree_add_item(tree, hf_Field1, tvb, offset, 1, ENC_BIG_ENDIAN); proto_tree_add_item(tree, hf_Spare, tvb, offset + 1, 1, ENC_BIG_ENDIAN); proto_tree_add_item(tree, hf_Field2, tvb, offset + 2, 2, ENC_BIG_ENDIAN); } Visually it works great in the Packet Details pane. The issue is that I don't want to allow any filtering based on the 'Spare' data field when the user is editing a Filter Expression. What is the recommended method to handle this scenario? Do I need to remove the hf_Spare structure from the hf_register_info array and use something like proto_tree_add_text? I also see something about PROTO_ITEM_SET_HIDDEN, but it doesn't look like it applies. Thanks, John Dill
___________________________________________________________________________ Sent via: Wireshark-dev mailing list <wireshark-dev () wireshark org> Archives: http://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:wireshark-dev-request () wireshark org?subject=unsubscribe
Current thread:
- displaying header field without filtering capability John Dill (Feb 19)
- Re: displaying header field without filtering capability Evan Huus (Feb 19)