I am writing a dissector for a custom protocol with pdus containing repetitive structures (the number of each structure is determined by a previous field whose value can be > 2000), possibly composed of other structures (think as "area descriptions" containing polylines / polygons, circles, ...) I need to display each of these structures as a subtree, containing other subtree if needed, and I understand that I must register a variable for each of them (> 2000 variables) with I do not need to retain the state (expanded or collapsed) of the tree for these structures, I just need the same default behavior for them when I first look at a packet (all expanded or all collapsed). Is there a way to do it without creating a lot of variables (register "less" element in How do you proceed when you need to dissect repeating structures ? Are there any best practices ? Thank you all for your advice(s) ! asked 14 Apr '16, 08:36 hpa |
One Answer:
You can re-use the same ett_xxx variable for each subtree, this just records the expanded\collapsed state of the subtree, so all that use the same variable will expand\collapse together. This is quite common in telemetry protocols, e.g. where a field device contains lots of data objects representing physical values such as analog and digital values. One such dissector is packet-dnp.c, but that is a very complex protocol so might not be the best example. The code to look at there is in answered 14 Apr '16, 09:03 grahamb ♦ |
I did that (reusing the same ett for each subtree type), and it's ok.
Thank you !