Wireshark-dev: Re: [Wireshark-dev] newbie question about dissecting protocol with many message subtypes

From: Andrew Schweitzer <a.schweitzer.grps@xxxxxxxxx>
Date: Sat, 02 Sep 2006 19:19:09 -0400

Guy Harris wrote:

The common practice, however, is to define one array, even with protocols that have one data structure per message. There is no practical difference between calling proto_register_field_array() once and calling it multiple times, other than the latter being slightly less efficient; the structure of the protocol doesn't dictate the way you register fields.

Ok, I think I got it, thanks. So I guess the hf[] array is just a flat repository for information about how to display fields in the gui? I suppose we use comments and field names (e.g. "field.subfield.subsubfield") to clarify what we are adding?

so hf[] might look like this:
hf[] = {
//Header fields
.... - actual declarations -
//Msg type X fields
.... - actual declarations -
//Msg type X+1 fields
... - actual declarations -

etc...?

If the first 3-5 fields are common to multiple message types, you'd only register each of those fields once, and use it in all of those message types.

Got it.