On 09/05/15 06:48, Alexis La Goutte wrote:
On Fri, Sep 4, 2015 at 9:15 PM, John Dill <john.d...@greenfieldeng.com
<mailto:john.d...@greenfieldeng.com>> wrote:
In other instances, I just want to assign a label to an
undissectable block of bytes in a packet that I do not want to be
filtered on, where I'd use:
proto_tree_add_text(pdu_tree, tvb, offset, pdu_payload_length, "Data
Payload");
Use proto_tree_add_item with hf use FT_NONE
Now, all field will be filtereable...
(it is possible to reuse the same hf for multiple field)
This shows up in the packet details pane and I can click on that
label and it would highlight the bytes in the packet bytes pane that
that block refers to. I have lots of these "Data Payload" since I
do not have complete documentation of the system, or it may be used
to read a data file from another aircraft that share some messages
but have others unprocessed.
It seems clunky to have to create header fields for each one of
these undissectable blobs, and I already have enough bogus "Spare"
and "Pad" header fields in the stuff I do know about to the point
that it takes 8-10 seconds to open up my specific protocol in the
filter expression dialog.
As Alexis said, feel free to re-use fields (especially spares and pads).
P.S. Also, when reading the documentation in README.heuristic, the
examples use the old prototype for heur_dissector_add.
on 1.99 branch ?
Change submitted:
https://code.wireshark.org/review/10445
___________________________________________________________________________
Sent via: Wireshark-dev mailing list <wireshark-dev@wireshark.org>
Archives: https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
mailto:wireshark-dev-requ...@wireshark.org?subject=unsubscribe
