How to replace the above expression to new add_item () for wire shark 2.2.6 without changing the representation output. I have used the output using
asked 02 May ‘17, 22:07 a6mishra edited 03 May ‘17, 03:05 grahamb ♦ |
One Answer:
As you have noted the perl script does not handle the way this dissector is coded. You will have to do the conversion by hand. The main reason for removing proto_tree_add_text() is to enforce the use of hf variables to facilitate filtering which is one of the main features of Wireshark. It will be difficult to not "changing the representation output". But changing it will actually improve the dissector in my opinion. For the example above I'd define 3 hf variables "tag" "datatype" and "value" and just do proto_tree_add_item() for each one of them. As an alternative you can use proto_tree_add_subtree_format() but that would defy the purpose of removing proto_tree_add_text(). answered 03 May '17, 03:56 Anders ♦ |