Riverbed Cascade Pilot Personal Edition: Take Wireshark to the Next Level - Advanced Triggers and Alerts; Web and VoIP Analytics; Long-Term Trending and Forensics; Deep Packet Analysis with Wireshark

Wireshark-dev: [Wireshark-dev] Problem with proto_tree_add_item

Date Index Thread Index Other Months All Mailing Lists

Date Prev Date Next Thread Prev Thread Next

From: Gerhard Gappmeier <gerhard.gappmeier@xxxxxxxxxxx>
Date: Thu, 01 Feb 2007 16:33:34 +0100

Hello,

I'm writing a dissector for a complex binary protocol that uses a lot of nested structures, that are serialized on the wire.
All complex types are built on top of some basic simple types.
I'm generating the complex type parsers with a self written code generator
and only write the parsers for the simple types by hand.
E.g. the Boolean DataType is used in many complex types.

static hf_register_info hf[] =
{
    { &hf_opcua_boolean,
    { "Boolean",                "",                   FT_BOOLEAN, BASE_DEC, NULL,    0x0,     "",    HFILL }
    },
...
}

/* Simple Type Boolean */
void parseBoolean(proto_tree *tree, tvbuff_t *tvb, gint *pOffset, char *szFieldName)
{
    proto_tree_add_item(tree, hf_opcua_boolean, tvb, *pOffset, 1, TRUE); *pOffset+=1;
}

/* Complex Type Reference Description */
void parseReferenceDescription(proto_tree *tree, tvbuff_t *tvb, gint *pOffset, char *szFieldName)
{
proto_item *ti = proto_tree_add_text(tree, tvb, 0, -1, szFieldName);
proto_tree *subtree = proto_item_add_subtree(ti, ett_opcua_ReferenceDescription);

parseNodeId(subtree, tvb, pOffset, "ReferenceTypeId");
parseBoolean(subtree, tvb, pOffset, "IsForward");
parseUInt32(subtree, tvb, pOffset, "ServerIndex");
parseExpandedNodeId(subtree, tvb, pOffset, "NodeId");
parseQualifiedName(subtree, tvb, pOffset, "BrowseName");
parseLocalizedText(subtree, tvb, pOffset, "DisplayName");
parseInt32(subtree, tvb, pOffset, "NodeClass");
parseExpandedNodeId(subtree, tvb, pOffset, "TypeDefinition");
}

The problem is, that I want to output the field name, and not the type of a field.
Is there a way to do that with hf_register_info?
The only solution I see is to use proto_tree_add_text instead and don't use hf_register_info
and format the data myself.
But than there is no relation between the protocol tree and the raw data window anymore.

Any ideas?

regards,
Gerhard.

Follow-Ups:
- Re: [Wireshark-dev] Problem with proto_tree_add_item
  - From: Guy Harris

Prev by Date: [Wireshark-dev] Patch to decode ERF type 5 record
Next by Date: [Wireshark-dev] [PATCH] Read VPI/VCI/CID information from K12xx .rf5 with extra_len == 0
Previous by thread: Re: [Wireshark-dev] Patch to decode ERF type 5 record
Next by thread: Re: [Wireshark-dev] Problem with proto_tree_add_item
Index(es):
- Date
- Thread