ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] How to format a subtree banner?

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 4 Aug 2010 19:20:09 -0700
On Aug 2, 2010, at 7:10 AM, eymanm wrote:

> Here's how the subtree is displayed (line numbers are added by me):
> 
> 1    1
> 2        String1 (1)
> 3        Value...displayed nice...
> ... Further values of the subtree...

OK, so the subtree has multiple values under it.

Given that, ...

> Line 1 is generated by proto_tree_add_uint_format() and proto_item_add_subtree() functions.

...line 1 should *NOT* correspond solely to the integral value, so you wouldn't use any of the proto_tree_add_uint functions.  It should also perhaps give information about the *other* values in that subtree.

> Line 2 is generated by proto_tree_add_item() function.

Do lines 2 and 3 *both* correspond to the integral value?  That seems redundant.  Or is it for another value that also goes into that subtree?

> There is an expansion "+" on line 1. So, if the branch is not expanded, only "1" is visible. My goal is to display both "String1" and "1" when the tree is not expanded.

	ti = proto_tree_add_text(tree, tvb, offset of the beginning of the first value covered by the subtree,
	    length of *all* the values covered by the subtree, "Subtree name: %s (%u) ...",
	    val_to_str(value, String, "Unknown"), value, other values to put into the item);
	subtree = proto_item_add_subtree(ti, ett_subtree);