ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] newbie question about dissecting protocol with many message

From: Andrew Schweitzer <a.schweitzer.grps@xxxxxxxxx>
Date: Sat, 02 Sep 2006 19:19:09 -0400
Guy Harris wrote:
The common practice, however, is to define one array, even with protocols that have one data structure per message. There is no practical difference between calling proto_register_field_array() once and calling it multiple times, other than the latter being slightly less efficient; the structure of the protocol doesn't dictate the way you register fields.


Ok, I think I got it, thanks. So I guess the hf[] array is just a flat repository for information about how to display fields in the gui? I suppose we use comments and field names (e.g. "field.subfield.subsubfield") to clarify what we are adding?

so hf[] might look like this:
hf[] = {
//Header fields
.... - actual declarations -
//Msg type X fields
.... - actual declarations -
//Msg type X+1 fields
... - actual declarations -

etc...?



If the first 3-5 fields are common to multiple message types, you'd only register each of those fields once, and use it in all of those message types.

Got it.