ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] Subtree array purpose

From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
Date: Fri, 29 Apr 2011 16:58:30 -0400
Max wrote:
Can anybody please explain the purpose of subtree array (ett_...)?

I don't get why should i have several different etts in my dissector's
code, while there is no information assotiated with these integers.

Each ett_ stores information about whether the particular subtree created using that variable is expanded or not.

For example, if a GUI user expands subtree B (but not A or C) and if the 3 subtrees use different ett_ variables then when the user clicks on the next packet then only subtree B will be automatically expanded. I find this behavior extremely useful when I'm comparing information (hanging off that subtree) between packets.

If OTOH only one ett_ variable is used for all 3 subtrees then all 3 subtrees in the next packet will be either expanded or collapsed (depending on the last action of the user on the last packet--whether they last expanded a subtree or collapsed one).