Wireshark

  • Riverbed Technology
  • WinPcap
the world's foremost network protocol analyzer
  • Wireshark
    • About
    • Download
    • Blog
  • Get Help
    • Ask a Question
    • FAQs
    • Documentation
    • Mailing Lists
    • Online Tools
    • Wiki
    • Bug Tracker
  • Develop
    • Get Involved
    • Developer's Guide
    • Browse the Code
    • Latest Builds

Wireshark-dev: Re: [Wireshark-dev] displaying TLV parameters- proto_tree_add_item_hidden for type no longer available, now have one line for type, one line for value

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next


From: <david.castleford@xxxxxxxxxxxxxxxxxx>
Date: Thu, 9 Oct 2008 15:53:30 +0200

Title: RE: [Wireshark-dev] displaying TLV parameters- proto_tree_add_item_hidden for type no longer available,now have one line for type, one line for value

 Hi Didier,

Good advice! Thanks.

Comment inline,

David

  • -----Message d'origine-----
  • De : wireshark-dev-bounces@xxxxxxxxxxxxx [mailto:wireshark-dev-bounces@xxxxxxxxxxxxx] De la part de didier
  • Envoyé : mercredi 8 octobre 2008 19:26
  • À : Developer support list for Wireshark
  • Objet : Re: [Wireshark-dev] displaying TLV parameters- proto_tree_add_item_hidden for type no longer available,now have one line for type, one line for value

  • Hi,
  • Le mercredi 08 octobre 2008 à 17:02 +0200, david.castleford@xxxxxxxxxxxxxxxxxx a écrit :
  • > Hi,
  • > 
  • > I've submitted a new dissector for Simulcrypt protocol and it contains
  • > TLV parameters (still fixing bugs).
  • > 
  • > I have a loop navigating through TLV parameters.
  • > 
  • > For each parameter I initally had:
  • > 
  • > proto_tree_add_item_hidden( simulcrypt_message_tree,
  • > hf_simulcrypt_parameter_type, tvb, offset, 2, FALSE );
  • > 
  • > (the benefit is being to search for simulcrypt.parameter_type)
  • > 
  • > And then I have a switch according to parameter type and use e.g.:
  • > 
  • > simulcrypt_item=proto_tree_add_item( simulcrypt_message_tree,
  • > hf_simulcrypt_ecm_channel_id, tvb, offset-plen,plen,FALSE);
  • > proto_item_append_text(simulcrypt_item, ", Length %d (bytes), Type 0x%
  • > 04x", plen,ptype); /* add length + type info to parameter */
  • > 
  • > This gave me one line per parameter being displayed (value, length,
  • > type):
  • > 
  • > ECM Channel ID: 0, Length 2 (bytes), Type 0x000e
  • > 
  • > Now before uploading a patch, I saw that the _hidden functions had
  • > been made obsolete, so I removed the _hidden, but it has the side
  • > effect of displaying an extra line per parameter, before the actual
  • > item being added:
  • > 
  • > Parameter Type: ECM_CHANNEL_ID (0x000e)
  • > <- this was originally hidden from display ECM Channel ID: 0, Length 2
  • > (bytes), Type 0x000e
  • > 
  • > As I have several parameters it is much less readable than when I had
  • > the _hidden part!
  • > 
  • > What do you recommend as a solution?
  • > Leave it as it is i.e. Parameter type on one length, then actual
  • > parameter value below?
  • > Or is there an easy fix (other than not adding the parameter type each
  • > time, losing the ability to search for simulcrypt.parameter_type)?
  • Did you try with a subtree?

Good idea, now have
+ Parameter Type: ECM_CHANNEL_ID (0x000e), Length=2 (bytes), Value=0x0000
        Length: 2 (bytes)                                       <- item in subtree
        ECM_Channel_ID: 0                                       <- item in subtree
+ Parameter Type:                                               <- next parameter type

It works as a plugin, need to recompile as dissector, make diff and upload new diff file.
Thanks for the tip.

David



  • Didier

  • >

  • _______________________________________________
  • Wireshark-dev mailing list
  • Wireshark-dev@xxxxxxxxxxxxx
  • https://wireshark.org/mailman/listinfo/wireshark-dev
  • References:
    • [Wireshark-dev] displaying TLV parameters - proto_tree_add_item_hidden for type no longer available, now have one line for type, one line for value
      • From: david.castleford
    • Re: [Wireshark-dev] displaying TLV parameters - proto_tree_add_item_hidden for type no longer available, now have one line for type, one line for value
      • From: didier
  • Prev by Date: Re: [Wireshark-dev] dropped packets stats for dumpcap/tshark ring buffer mode
  • Next by Date: Re: [Wireshark-dev] dropped packets stats for dumpcap/tshark ring buffer mode
  • Previous by thread: Re: [Wireshark-dev] displaying TLV parameters - proto_tree_add_item_hidden for type no longer available, now have one line for type, one line for value
  • Next by thread: Re: [Wireshark-dev] [Wireshark-commits] rev 26376: /trunk/ /trunk/: manuf
  • Index(es):
    • Date
    • Thread

Wireshark and the "fin" logo are registered trademarks of the Wireshark Foundation