This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How should I register a header field that only shows a string?

0

Hi I'm creating a header item that says "General Information", and I also made a subtree on this item. The thing is, I don't know how to set its registration infoamtion in hf_register_info, to be exact, the FIELDNAME and ABBREVIATION field.

This is my code for creating the item:

proto_item *gi = proto_tree_add_string(afdx_tree, hf_gi, tvb, 0, 0, "General Information");

This is the hf_register_info

{ &hf_gi,
//      What to put here       and here
    { "General Information", "foo.gi",
    FT_STRING, STR_ASCII,
    NULL, 0x0,
    NULL, HFILL }
},

Also, sometimes I want to handle display manually. Is calling proto_tree_add_string() with self-generated string the right(wireshark's) way to do it? The information I wish to present require more input data than allowed by BASE_CUSTOM, which calls void func(gchar*, guint32), and only takes one input directly excerpted from the raw packet

Thank you all for your help!

asked 20 Jul '17, 01:01

nickzhang's gravatar image

nickzhang
16448
accept rate: 0%

edited 20 Jul '17, 01:04


One Answer:

0

What to put here and here

If by "here" and "here" you mean "for FIELDNAME" and "for ABBREVIATION", there's nothing special about strings - if the field is called "general information" in descriptions of the protocol, either "General information" or "General Information" is an appropriate FIELDNAME and, if the protocol's abbreviation is "foo", then "foo.gi" or "foo.general_information" would be an appropriate ABBREVIATION, and that'd be the case if it were a string or a number or....

Also, sometimes I want to handle display manually. Is calling proto_tree_add_string() with self-generated string the right(wireshark's) way to do it?

If the value of the string is exactly what appears in the packet, and you just want to change the way it's displayed, proto_tree_add_string_format_value() is probably the right way to do it. Use proto_tree_add_string() only if the actual value is something you'd need to compute from the contents of the packet rather than just being what's in the packet.

answered 20 Jul '17, 04:11

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%

This answers my question, thank you.

(20 Jul '17, 18:39) nickzhang