Wireshark mailing list archives

Re: Trying to submit a patch


From: Jeff Morriss <jeff.morriss.ws () gmail com>
Date: Tue, 8 Sep 2015 11:41:03 -0400

On 09/05/15 06:48, Alexis La Goutte wrote:
On Fri, Sep 4, 2015 at 9:15 PM, John Dill <John.Dill () greenfieldeng com
<mailto:John.Dill () greenfieldeng com>> wrote:
    In other instances, I just want to assign a label to an
    undissectable block of bytes in a packet that I do not want to be
    filtered on, where I'd use:

    proto_tree_add_text(pdu_tree, tvb, offset, pdu_payload_length, "Data
    Payload");

Use proto_tree_add_item with hf use FT_NONE

Now, all field will be filtereable...
(it is possible to reuse the same hf for multiple field)


    This shows up in the packet details pane and I can click on that
    label and it would highlight the bytes in the packet bytes pane that
    that block refers to.  I have lots of these "Data Payload" since I
    do not have complete documentation of the system, or it may be used
    to read a data file from another aircraft that share some messages
    but have others unprocessed.

    It seems clunky to have to create header fields for each one of
    these undissectable blobs, and I already have enough bogus "Spare"
    and "Pad" header fields in the stuff I do know about to the point
    that it takes 8-10 seconds to open up my specific protocol in the
    filter expression dialog.

As Alexis said, feel free to re-use fields (especially spares and pads).

    P.S. Also, when reading the documentation in README.heuristic, the
    examples use the old prototype for heur_dissector_add.

on 1.99 branch ?

Change submitted:

https://code.wireshark.org/review/10445

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
            mailto:wireshark-dev-request () wireshark org?subject=unsubscribe


Current thread: