On Feb 23, 2014, at 5:12 PM, "??????????" <237825...@qq.com> wrote:
> thanks.you mean that the display operation is done in the dissector,right?
Wrong.
It's done by code in the ui/gtk directory for the GTK+ version and in code in
the ui/qt directory for the Qt version.
What the dissector does is construct a protocol tree and set some address,
port, and column values.
When the dissection is finished, the display code - which is *not* part of your
dissector! - takes the address, port, and column values and, for custom
columns, values from the protocol tree, and sets the columns of the packet list
from that, and takes the protocol tree and sets the packet detail view.
> but i want to change the display infomation
What do you want to change?
> and what infomation will be display in the packet view,is that column_info?
The main Wireshark display has three sections:
the packet list, which is where the column info shows up - there's one
row in the packet list for each low-level packet;
the packet details, which is where the protocol tree shows up - it
shows the detailed dissection of whatever packet has been selected in the
packet list;
the hex dump - it shows the raw data being dissected for whatever
packet has been selected in the packet list.
___________________________________________________________________________
Sent via: Wireshark-dev mailing list <wireshark-dev@wireshark.org>
Archives: http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
mailto:wireshark-dev-requ...@wireshark.org?subject=unsubscribe
