ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] proto_tree_add_item() with range_string

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Fri, 12 Jan 2007 12:11:00 -0800
Sebastien Tandel wrote:

If you want something cleaner ... one of the solution may be a
intermediate structure which is mandatory with well-defined values to
determine which structure it encapsulates. => need changes then in the
macros VALS, TFS and even in the dissectors using VALS, TFS

That's one way to do it.

Another is to note that there's a field "display" in the header_field_info structure. It currently just holds a base indication for numbers, but it could be treated as a general "how to display this field" indicator, with additional information such as, for numbers, "display this as a numerical value"/"display this as a numerical value and a symbolic interpretation using a value_string table"/"display this as a numerical value with a range-based description"/etc..

Unfortunately, that won't work for FT_BOOLEAN, as, for Boolean bitfields, "display" holds the value of the bigger item in which the bitfield is packed.