This is our old Q&A Site. Please post any new questions and answers at


I am writing a custom Wireshark dissector which needs to show some strings. Let me say there is some hex code like "48 65 6c 6c 6f" which is "Hello". This is interpreted fine by using FT_STRING in the hf_ declaration. If this hex codes contain something like "48 65 6c 6c 6f 00 48 65 6c 6c 6f", the second "Hello" gets not displayed in the UI. I assume it is because of the "00" in between. Is there a way to convince Wireshark not to interpret "00" as a string termination but continue displaying the string?

Thanks, hhhannes

asked 01 Oct '13, 01:45

hhhannes's gravatar image

accept rate: 0%

Be the first one to answer this question!
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 01 Oct '13, 01:45

question was seen: 1,520 times

last updated: 01 Oct '13, 01:45

p​o​w​e​r​e​d by O​S​Q​A