Wireshark  4.3.0
The Wireshark network protocol analyzer
Classes | Macros | Typedefs | Enumerations | Functions | Variables
The Protocol Tree

Classes

struct  _header_field_info
 
struct  hf_register_info
 
struct  _item_label_t
 
struct  field_info
 
struct  crumb_spec_t
 
struct  tree_data_t
 
struct  _proto_node
 
struct  proto_plugin
 
struct  _mac_hf_list_t
 

Macros

#define ITEM_LABEL_LENGTH   240
 
#define ITEM_LABEL_UNKNOWN_STR   "Unknown"
 
#define cast_same(type, x)   (0 ? (type)0 : (x))
 
#define VALS(x)   (cast_same(const struct _value_string*, (x)))
 
#define VALS64(x)   (cast_same(const struct _val64_string*, (x)))
 
#define VALS_EXT_PTR(x)   (cast_same(value_string_ext*, (x)))
 
#define TFS(x)   (cast_same(const struct true_false_string*, (x)))
 
#define CF_FUNC(x)   ((const void *) (gsize) (x))
 
#define RVALS(x)   (cast_same(const struct _range_string*, (x)))
 
#define FRAMENUM_TYPE(x)   GINT_TO_POINTER(x)
 
#define REPORT_DISSECTOR_BUG(...)    proto_report_dissector_bug(__VA_ARGS__)
 
#define __DISSECTOR_ASSERT_STATIC_ANALYSIS_HINT(expression)
 
#define __DISSECTOR_ASSERT_STRINGIFY(s)   # s
 
#define __DISSECTOR_ASSERT(expression, file, lineno)
 
#define __DISSECTOR_ASSERT_HINT(expression, file, lineno, hint)
 
#define DISSECTOR_ASSERT(expression)
 
#define DISSECTOR_ASSERT_HINT(expression, hint)
 
#define DISSECTOR_ASSERT_NOT_REACHED()
 
#define __DISSECTOR_ASSERT_CMPINT(a, op, b, type, fmt)
 
#define DISSECTOR_ASSERT_CMPINT(a, op, b)
 
#define DISSECTOR_ASSERT_CMPUINT(a, op, b)
 
#define DISSECTOR_ASSERT_CMPUINTHEX(a, op, b)
 
#define __DISSECTOR_ASSERT_FIELD_TYPE(hfinfo, t)
 
#define DISSECTOR_ASSERT_FIELD_TYPE(hfinfo, t)
 
#define DISSECTOR_ASSERT_FIELD_TYPE_IS_INTEGRAL(hfinfo)
 
#define __DISSECTOR_ASSERT_FIELD_TYPE_IS_STRING(hfinfo)
 
#define DISSECTOR_ASSERT_FIELD_TYPE_IS_STRING(hfinfo)
 
#define __DISSECTOR_ASSERT_FIELD_TYPE_IS_TIME(hfinfo)
 
#define DISSECTOR_ASSERT_FIELD_TYPE_IS_TIME(hfinfo)
 
#define ENC_BIG_ENDIAN   0x00000000
 
#define ENC_LITTLE_ENDIAN   0x80000000
 
#define ENC_HOST_ENDIAN   ENC_LITTLE_ENDIAN
 
#define ENC_ANTI_HOST_ENDIAN   ENC_BIG_ENDIAN
 
#define ENC_NA   0x00000000
 
#define ENC_CHARENCODING_MASK   0x0000FFFE /* mask out byte-order bits and other bits used with string encodings */
 
#define ENC_ASCII   0x00000000
 
#define ENC_ISO_646_IRV   ENC_ASCII /* ISO 646 International Reference Version = ASCII */
 
#define ENC_UTF_8   0x00000002
 
#define ENC_UTF_16   0x00000004
 
#define ENC_UCS_2   0x00000006
 
#define ENC_UCS_4   0x00000008
 
#define ENC_ISO_8859_1   0x0000000A
 
#define ENC_ISO_8859_2   0x0000000C
 
#define ENC_ISO_8859_3   0x0000000E
 
#define ENC_ISO_8859_4   0x00000010
 
#define ENC_ISO_8859_5   0x00000012
 
#define ENC_ISO_8859_6   0x00000014
 
#define ENC_ISO_8859_7   0x00000016
 
#define ENC_ISO_8859_8   0x00000018
 
#define ENC_ISO_8859_9   0x0000001A
 
#define ENC_ISO_8859_10   0x0000001C
 
#define ENC_ISO_8859_11   0x0000001E
 
#define ENC_ISO_8859_13   0x00000022
 
#define ENC_ISO_8859_14   0x00000024
 
#define ENC_ISO_8859_15   0x00000026
 
#define ENC_ISO_8859_16   0x00000028
 
#define ENC_WINDOWS_1250   0x0000002A
 
#define ENC_3GPP_TS_23_038_7BITS_PACKED   0x0000002C
 
#define ENC_3GPP_TS_23_038_7BITS   ENC_3GPP_TS_23_038_7BITS_PACKED
 
#define ENC_EBCDIC   0x0000002E
 
#define ENC_MAC_ROMAN   0x00000030
 
#define ENC_CP437   0x00000032
 
#define ENC_ASCII_7BITS   0x00000034
 
#define ENC_T61   0x00000036
 
#define ENC_EBCDIC_CP037   0x00000038
 
#define ENC_WINDOWS_1252   0x0000003A
 
#define ENC_WINDOWS_1251   0x0000003C
 
#define ENC_CP855   0x0000003E
 
#define ENC_CP866   0x00000040
 
#define ENC_ISO_646_BASIC   0x00000042
 
#define ENC_BCD_DIGITS_0_9   0x00000044 /* Packed BCD, digits 0-9 */
 
#define ENC_KEYPAD_ABC_TBCD   0x00000046 /* Keypad-with-a/b/c "telephony BCD" = 0-9, *, #, a, b, c */
 
#define ENC_KEYPAD_BC_TBCD   0x00000048 /* Keypad-with-B/C "telephony BCD" = 0-9, B, C, *, # */
 
#define ENC_3GPP_TS_23_038_7BITS_UNPACKED   0x0000004C
 
#define ENC_ETSI_TS_102_221_ANNEX_A   0x0000004E /* ETSI TS 102 221 Annex A */
 
#define ENC_GB18030   0x00000050
 
#define ENC_EUC_KR   0x00000052
 
#define ENC_APN_STR   0x00000054 /* The encoding the APN/DNN field follows 3GPP TS 23.003 [2] clause 9.1.*/
 
#define ENC_DECT_STANDARD_8BITS   0x00000056 /* DECT standard character set as defined in ETSI EN 300 175-5 Annex D */
 
#define ENC_DECT_STANDARD_4BITS_TBCD   0x00000058 /* DECT standard 4bits character set as defined in ETSI EN 300 175-5 Annex D (BCD with 0xb = SPACE)*/
 
#define ENC_EBCDIC_CP500   0x00000060
 
#define ENC_ZIGBEE   0x40000000
 
#define ENC_BOM   0x20000000
 
#define ENC_STR_NUM   0x01000000
 
#define ENC_STR_HEX   0x02000000
 
#define ENC_STRING   0x03000000
 
#define ENC_STR_MASK   0x0000FFFE
 
#define ENC_NUM_PREF   0x00200000
 
#define ENC_SEP_NONE   0x00010000
 
#define ENC_SEP_COLON   0x00020000
 
#define ENC_SEP_DASH   0x00040000
 
#define ENC_SEP_DOT   0x00080000
 
#define ENC_SEP_SPACE   0x00100000
 
#define ENC_SEP_MASK   0x001F0000
 
#define ENC_BCD_ODD_NUM_DIG   0x00010000
 
#define ENC_BCD_SKIP_FIRST   0x00020000
 
#define ENC_TIME_SECS_NSECS   0x00000000
 
#define ENC_TIME_TIMESPEC   0x00000000 /* for backwards source compatibility */
 
#define ENC_TIME_NTP   0x00000002
 
#define ENC_TIME_TOD   0x00000004
 
#define ENC_TIME_RTPS   0x00000008
 
#define ENC_TIME_NTP_BASE_ZERO   0x00000008 /* for backwards source compatibility */
 
#define ENC_TIME_SECS_USECS   0x00000010
 
#define ENC_TIME_TIMEVAL   0x00000010 /* for backwards source compatibility */
 
#define ENC_TIME_SECS   0x00000012
 
#define ENC_TIME_MSECS   0x00000014
 
#define ENC_TIME_SECS_NTP   0x00000018
 
#define ENC_TIME_RFC_3971   0x00000020
 
#define ENC_TIME_MSEC_NTP   0x00000022
 
#define ENC_TIME_MIP6   0x00000024
 
#define ENC_TIME_CLASSIC_MAC_OS_SECS   0x00000026
 
#define ENC_TIME_NSECS   0x00000028
 
#define ENC_TIME_USECS   0x00000030
 
#define ENC_ISO_8601_DATE   0x00010000
 
#define ENC_ISO_8601_TIME   0x00020000
 
#define ENC_ISO_8601_DATE_TIME   0x00030000
 
#define ENC_IMF_DATE_TIME   0x00040000 /* Internet Message Format - RFCs 822, 1123, 2822, 5322 */
 
#define ENC_RFC_822   0x00040000 /* backwards compatibility */
 
#define ENC_RFC_1123   0x00040000 /* backwards source compatibility - not binary */
 
#define ENC_ISO_8601_DATE_TIME_BASIC   0x00100000
 
#define ENC_STR_TIME_MASK   0x001F0000
 
#define ENC_VARINT_PROTOBUF   0x00000002
 
#define ENC_VARINT_QUIC   0x00000004
 
#define ENC_VARINT_ZIGZAG   0x00000008
 
#define ENC_VARINT_SDNV   0x00000010
 
#define ENC_VARINT_MASK   (ENC_VARINT_PROTOBUF|ENC_VARINT_QUIC|ENC_VARINT_ZIGZAG|ENC_VARINT_SDNV)
 
#define FIELD_DISPLAY_E_MASK   0xFF
 
#define FIELD_DISPLAY(d)   ((d) & FIELD_DISPLAY_E_MASK)
 
#define FIELD_DISPLAY_IS_ABSOLUTE_TIME(d)    (FIELD_DISPLAY(d) >= ABSOLUTE_TIME_LOCAL && FIELD_DISPLAY(d) <= ABSOLUTE_TIME_UNIX)
 
#define BASE_RANGE_STRING   0x00000100
 
#define BASE_EXT_STRING   0x00000200
 
#define BASE_VAL64_STRING   0x00000400
 
#define BASE_ALLOW_ZERO   0x00000800
 
#define BASE_UNIT_STRING   0x00001000
 
#define BASE_NO_DISPLAY_VALUE   0x00002000
 
#define BASE_PROTOCOL_INFO   0x00004000
 
#define BASE_SPECIAL_VALS   0x00008000
 
#define BASE_SHOW_ASCII_PRINTABLE   0x00010000
 
#define BASE_SHOW_UTF_8_PRINTABLE   0x00020000
 
#define IS_BASE_DUAL(b)   ((b)==BASE_DEC_HEX||(b)==BASE_HEX_DEC)
 
#define IS_BASE_PORT(b)   (((b)==BASE_PT_UDP||(b)==BASE_PT_TCP||(b)==BASE_PT_DCCP||(b)==BASE_PT_SCTP))
 
#define HFILL   -1, 0, HF_REF_TYPE_NONE, -1, NULL
 
#define HFILL_INIT(hf)
 
#define FI_HIDDEN   0x00000001
 
#define FI_GENERATED   0x00000002
 
#define FI_URL   0x00000004
 
#define FI_LITTLE_ENDIAN   0x00000008
 
#define FI_BIG_ENDIAN   0x00000010
 
#define FI_BITS_OFFSET(n)   (((n) & 7) << 5)
 
#define FI_BITS_SIZE(n)   (((n) & 63) << 8)
 
#define FI_VARINT   0x00004000
 
#define FI_GET_FLAG(fi, flag)   ((fi) ? ((fi)->flags & (flag)) : 0)
 
#define FI_SET_FLAG(fi, flag)
 
#define FI_RESET_FLAG(fi, flag)
 
#define FI_GET_BITS_OFFSET(fi)   (FI_GET_FLAG(fi, FI_BITS_OFFSET(7)) >> 5)
 
#define FI_GET_BITS_SIZE(fi)   (FI_GET_FLAG(fi, FI_BITS_SIZE(63)) >> 8)
 
#define PI_SEVERITY_MASK   0x00F00000
 
#define PI_COMMENT   0x00100000
 
#define PI_CHAT   0x00200000
 
#define PI_NOTE   0x00400000
 
#define PI_WARN   0x00600000
 
#define PI_ERROR   0x00800000
 
#define PI_GROUP_MASK   0xFF000000
 
#define PI_CHECKSUM   0x01000000
 
#define PI_SEQUENCE   0x02000000
 
#define PI_RESPONSE_CODE   0x03000000
 
#define PI_REQUEST_CODE   0x04000000
 
#define PI_UNDECODED   0x05000000
 
#define PI_REASSEMBLE   0x06000000
 
#define PI_MALFORMED   0x07000000
 
#define PI_DEBUG   0x08000000
 
#define PI_PROTOCOL   0x09000000
 
#define PI_SECURITY   0x0a000000
 
#define PI_COMMENTS_GROUP   0x0b000000
 
#define PI_DECRYPTION   0x0c000000
 
#define PI_ASSUMPTION   0x0d000000
 
#define PI_DEPRECATED   0x0e000000
 
#define PI_RECEIVE   0x0f000000
 
#define PI_INTERFACE   0x10000000
 
#define PNODE_FINFO(proto_node)   ((proto_node)->finfo)
 
#define PITEM_FINFO(proto_item)   PNODE_FINFO(proto_item)
 
#define PTREE_FINFO(proto_tree)   PNODE_FINFO(proto_tree)
 
#define PTREE_DATA(proto_tree)   ((proto_tree)->tree_data)
 
#define PNODE_POOL(proto_node)   ((proto_node)->tree_data->pinfo->pool)
 
#define PROTO_ITEM_IS_HIDDEN(ti)   proto_item_is_hidden((ti))
 
#define PROTO_ITEM_SET_HIDDEN(ti)   proto_item_set_hidden((ti))
 
#define PROTO_ITEM_SET_VISIBLE(ti)   proto_item_set_visible((ti))
 
#define PROTO_ITEM_IS_GENERATED(ti)   proto_item_is_generated((ti))
 
#define PROTO_ITEM_SET_GENERATED(ti)   proto_item_set_generated((ti))
 
#define PROTO_ITEM_IS_URL(ti)   proto_item_is_url((ti))
 
#define PROTO_ITEM_SET_URL(ti)   proto_item_set_url((ti))
 
#define g_ptr_array_len(a)   ((a)?(a)->len:0)
 
#define BMT_NO_FLAGS   0x00
 
#define BMT_NO_APPEND   0x01
 
#define BMT_NO_INT   0x02
 
#define BMT_NO_FALSE   0x04
 
#define BMT_NO_TFS   0x08
 
#define PROTO_CHECKSUM_NO_FLAGS   0x00
 
#define PROTO_CHECKSUM_VERIFY   0x01
 
#define PROTO_CHECKSUM_GENERATED   0x02
 
#define PROTO_CHECKSUM_IN_CKSUM   0x04
 
#define PROTO_CHECKSUM_ZERO   0x08
 
#define PROTO_CHECKSUM_NOT_PRESENT   0x10
 

Typedefs

typedef void(* custom_fmt_func_t) (gchar *, guint32)
 
typedef void(* custom_fmt_func_64_t) (gchar *, guint64)
 
typedef void(* custom_fmt_func_double_t) (gchar *, double)
 
typedef struct _protocol protocol_t
 
typedef struct _header_field_info header_field_info
 
typedef struct hf_register_info hf_register_info
 
typedef struct _item_label_t item_label_t
 
typedef struct field_info field_info
 
typedef struct _proto_node proto_node
 
typedef proto_node proto_tree
 
typedef proto_node proto_item
 
typedef void(* proto_tree_foreach_func) (proto_node *, gpointer)
 
typedef gboolean(* proto_tree_traverse_func) (proto_node *, gpointer)
 
typedef WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item struct _mac_hf_list_t mac_hf_list_t
 
typedef void(* prefix_initializer_t) (const char *match)
 

Enumerations

enum  field_display_e {
  BASE_NONE = 0 , BASE_DEC , BASE_HEX , BASE_OCT ,
  BASE_DEC_HEX , BASE_HEX_DEC , BASE_CUSTOM , BASE_EXP ,
  SEP_DOT , SEP_DASH , SEP_COLON , SEP_SPACE ,
  BASE_NETMASK , BASE_PT_UDP , BASE_PT_TCP , BASE_PT_DCCP ,
  BASE_PT_SCTP , BASE_OUI , ABSOLUTE_TIME_LOCAL , ABSOLUTE_TIME_UTC ,
  ABSOLUTE_TIME_DOY_UTC , ABSOLUTE_TIME_NTP_UTC , ABSOLUTE_TIME_UNIX , BASE_STR_WSP
}
 
enum  hf_ref_type { HF_REF_TYPE_NONE , HF_REF_TYPE_INDIRECT , HF_REF_TYPE_DIRECT , HF_REF_TYPE_PRINT }
 
enum  proto_checksum_enum_e {
  PROTO_CHECKSUM_E_BAD = 0 , PROTO_CHECKSUM_E_GOOD , PROTO_CHECKSUM_E_UNVERIFIED , PROTO_CHECKSUM_E_NOT_PRESENT ,
  PROTO_CHECKSUM_E_ILLEGAL
}
 

Functions

WS_DLL_PUBLIC WS_NORETURN void proto_report_dissector_bug (const char *format,...) G_GNUC_PRINTF(1
 
WS_DLL_PUBLIC void proto_tree_children_foreach (proto_tree *tree, proto_tree_foreach_func func, gpointer data)
 
WS_DLL_PUBLIC void proto_register_plugin (const proto_plugin *plugin)
 
void proto_init (GSList *register_all_plugin_protocols_list, GSList *register_all_plugin_handoffs_list, register_cb cb, void *client_data)
 
void proto_cleanup (void)
 
WS_DLL_PUBLIC gboolean proto_field_is_referenced (proto_tree *tree, int proto_id)
 
WS_DLL_PUBLIC proto_treeproto_item_add_subtree (proto_item *pi, const gint idx) G_GNUC_WARN_UNUSED_RESULT
 
WS_DLL_PUBLIC proto_treeproto_item_get_subtree (proto_item *pi)
 
WS_DLL_PUBLIC proto_itemproto_item_get_parent (const proto_item *pi)
 
WS_DLL_PUBLIC proto_itemproto_item_get_parent_nth (proto_item *pi, int gen)
 
WS_DLL_PUBLIC void proto_item_set_text (proto_item *pi, const char *format,...) G_GNUC_PRINTF(2
 
WS_DLL_PUBLIC void WS_DLL_PUBLIC void proto_item_append_text (proto_item *pi, const char *format,...) G_GNUC_PRINTF(2
 
WS_DLL_PUBLIC void WS_DLL_PUBLIC void WS_DLL_PUBLIC void proto_item_prepend_text (proto_item *pi, const char *format,...) G_GNUC_PRINTF(2
 
WS_DLL_PUBLIC void WS_DLL_PUBLIC void WS_DLL_PUBLIC void WS_DLL_PUBLIC void proto_item_set_len (proto_item *pi, const gint length)
 
WS_DLL_PUBLIC void proto_item_set_end (proto_item *pi, tvbuff_t *tvb, gint end)
 
WS_DLL_PUBLIC int proto_item_get_len (const proto_item *pi)
 
WS_DLL_PUBLIC void proto_item_set_bits_offset_len (proto_item *ti, int bits_offset, int bits_len)
 
WS_DLL_PUBLIC char * proto_item_get_display_repr (wmem_allocator_t *scope, proto_item *pi)
 
proto_treeproto_tree_create_root (struct _packet_info *pinfo)
 
void proto_tree_reset (proto_tree *tree)
 
WS_DLL_PUBLIC void proto_tree_free (proto_tree *tree)
 
WS_DLL_PUBLIC gboolean proto_tree_set_visible (proto_tree *tree, gboolean visible)
 
void proto_tree_set_fake_protocols (proto_tree *tree, gboolean fake_protocols)
 
void proto_tree_prime_with_hfid (proto_tree *tree, const int hfid)
 
void proto_tree_prime_with_hfid_print (proto_tree *tree, const int hfid)
 
WS_DLL_PUBLIC proto_itemproto_tree_get_parent (proto_tree *tree)
 
WS_DLL_PUBLIC proto_treeproto_tree_get_parent_tree (proto_tree *tree)
 
WS_DLL_PUBLIC proto_treeproto_tree_get_root (proto_tree *tree)
 
WS_DLL_PUBLIC void proto_tree_move_item (proto_tree *tree, proto_item *fixed_item, proto_item *item_to_move)
 
WS_DLL_PUBLIC void proto_tree_set_appendix (proto_tree *tree, tvbuff_t *tvb, gint start, const gint length)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_item_new (proto_tree *tree, header_field_info *hfinfo, tvbuff_t *tvb, const gint start, gint length, const guint encoding)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_item (proto_tree *tree, int hfindex, tvbuff_t *tvb, const gint start, gint length, const guint encoding)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_item_new_ret_length (proto_tree *tree, header_field_info *hfinfo, tvbuff_t *tvb, const gint start, gint length, const guint encoding, gint *lenretval)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_item_ret_length (proto_tree *tree, int hfindex, tvbuff_t *tvb, const gint start, gint length, const guint encoding, gint *lenretval)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_item_ret_int (proto_tree *tree, int hfindex, tvbuff_t *tvb, const gint start, gint length, const guint encoding, gint32 *retval)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_item_ret_int64 (proto_tree *tree, int hfindex, tvbuff_t *tvb, const gint start, gint length, const guint encoding, gint64 *retval)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_item_ret_uint (proto_tree *tree, int hfindex, tvbuff_t *tvb, const gint start, gint length, const guint encoding, guint32 *retval)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_item_ret_uint64 (proto_tree *tree, int hfindex, tvbuff_t *tvb, const gint start, gint length, const guint encoding, guint64 *retval)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_item_ret_varint (proto_tree *tree, int hfindex, tvbuff_t *tvb, const gint start, gint length, const guint encoding, guint64 *retval, gint *lenretval)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_item_ret_boolean (proto_tree *tree, int hfindex, tvbuff_t *tvb, const gint start, gint length, const guint encoding, gboolean *retval)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_item_ret_ipv4 (proto_tree *tree, int hfindex, tvbuff_t *tvb, const gint start, gint length, const guint encoding, ws_in4_addr *retval)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_item_ret_ipv6 (proto_tree *tree, int hfindex, tvbuff_t *tvb, const gint start, gint length, const guint encoding, ws_in6_addr *retval)
 Parse an ipv6 address from the buffer and add it to the tree, writing the value to the pointer specified by the caller. The pointer must not be null. More...
 
WS_DLL_PUBLIC proto_itemproto_tree_add_item_ret_ether (proto_tree *tree, int hfindex, tvbuff_t *tvb, const gint start, gint length, const guint encoding, guint8 *retval)
 Parse an ethernet address from the buffer and add it to the tree, writing the value to the pointer specified by the caller. The pointer must not be null. More...
 
WS_DLL_PUBLIC proto_itemproto_tree_add_item_ret_float (proto_tree *tree, int hfindex, tvbuff_t *tvb, const gint start, gint length, const guint encoding, gfloat *retval)
 Parse a float from the buffer and add it to the tree, returning the item added and the parsed value via retval. More...
 
WS_DLL_PUBLIC proto_itemproto_tree_add_item_ret_double (proto_tree *tree, int hfindex, tvbuff_t *tvb, const gint start, gint length, const guint encoding, gdouble *retval)
 Parse a double from the buffer and add it to the tree, returning the item added and the parsed value via retval. More...
 
WS_DLL_PUBLIC proto_itemproto_tree_add_item_ret_string_and_length (proto_tree *tree, int hfindex, tvbuff_t *tvb, const gint start, gint length, const guint encoding, wmem_allocator_t *scope, const guint8 **retval, gint *lenretval)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_item_ret_string (proto_tree *tree, int hfindex, tvbuff_t *tvb, const gint start, gint length, const guint encoding, wmem_allocator_t *scope, const guint8 **retval)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_item_ret_display_string_and_length (proto_tree *tree, int hfindex, tvbuff_t *tvb, const gint start, gint length, const guint encoding, wmem_allocator_t *scope, char **retval, gint *lenretval)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_item_ret_display_string (proto_tree *tree, int hfindex, tvbuff_t *tvb, const gint start, gint length, const guint encoding, wmem_allocator_t *scope, char **retval)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_item_ret_time_string (proto_tree *tree, int hfindex, tvbuff_t *tvb, const gint start, gint length, const guint encoding, wmem_allocator_t *scope, char **retval)
 
proto_itemproto_tree_add_text_internal (proto_tree *tree, tvbuff_t *tvb, gint start, gint length, const char *format,...) G_GNUC_PRINTF(5
 
proto_item proto_itemproto_tree_add_text_valist_internal (proto_tree *tree, tvbuff_t *tvb, gint start, gint length, const char *format, va_list ap) G_GNUC_PRINTF(5
 
proto_item proto_item WS_DLL_PUBLIC proto_treeproto_tree_add_subtree (proto_tree *tree, tvbuff_t *tvb, gint start, gint length, gint idx, proto_item **tree_item, const char *text)
 
WS_DLL_PUBLIC proto_treeproto_tree_add_subtree_format (proto_tree *tree, tvbuff_t *tvb, gint start, gint length, gint idx, proto_item **tree_item, const char *format,...) G_GNUC_PRINTF(7
 
WS_DLL_PUBLIC proto_tree proto_itemproto_tree_add_format_text (proto_tree *tree, tvbuff_t *tvb, gint start, gint length)
 
proto_itemproto_tree_add_format_wsp_text (proto_tree *tree, tvbuff_t *tvb, gint start, gint length)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_none_format (proto_tree *tree, const int hfindex, tvbuff_t *tvb, const gint start, gint length, const char *format,...) G_GNUC_PRINTF(6
 
WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_itemproto_tree_add_protocol_format (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, const char *format,...) G_GNUC_PRINTF(6
 
WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_itemproto_tree_add_bytes (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, const guint8 *start_ptr)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_bytes_with_length (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, const guint8 *start_ptr, gint ptr_length)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_bytes_item (proto_tree *tree, int hfindex, tvbuff_t *tvb, const gint start, gint length, const guint encoding, GByteArray *retval, gint *endoff, gint *err)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_bytes_format_value (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, const guint8 *start_ptr, const char *format,...) G_GNUC_PRINTF(7
 
WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_itemproto_tree_add_bytes_format (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, const guint8 *start_ptr, const char *format,...) G_GNUC_PRINTF(7
 
WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_itemproto_tree_add_time (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, const nstime_t *value_ptr)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_time_item (proto_tree *tree, int hfindex, tvbuff_t *tvb, const gint start, gint length, const guint encoding, nstime_t *retval, gint *endoff, gint *err)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_time_format_value (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, nstime_t *value_ptr, const char *format,...) G_GNUC_PRINTF(7
 
WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_itemproto_tree_add_time_format (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, nstime_t *value_ptr, const char *format,...) G_GNUC_PRINTF(7
 
WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_itemproto_tree_add_ipxnet (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, guint32 value)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_ipxnet_format_value (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, guint32 value, const char *format,...) G_GNUC_PRINTF(7
 
WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_itemproto_tree_add_ipxnet_format (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, guint32 value, const char *format,...) G_GNUC_PRINTF(7
 
WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_itemproto_tree_add_ipv4 (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, ws_in4_addr value)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_ipv4_format_value (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, ws_in4_addr value, const char *format,...) G_GNUC_PRINTF(7
 
WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_itemproto_tree_add_ipv4_format (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, ws_in4_addr value, const char *format,...) G_GNUC_PRINTF(7
 
WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_itemproto_tree_add_ipv6 (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, const ws_in6_addr *value_ptr)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_ipv6_format_value (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, const ws_in6_addr *value_ptr, const char *format,...) G_GNUC_PRINTF(7
 
WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_itemproto_tree_add_ipv6_format (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, const ws_in6_addr *value_ptr, const char *format,...) G_GNUC_PRINTF(7
 
WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_itemproto_tree_add_ether (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, const guint8 *value)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_ether_format_value (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, const guint8 *value, const char *format,...) G_GNUC_PRINTF(7
 
WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_itemproto_tree_add_ether_format (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, const guint8 *value, const char *format,...) G_GNUC_PRINTF(7
 
WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_itemproto_tree_add_guid (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, const e_guid_t *value_ptr)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_guid_format_value (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, const e_guid_t *value_ptr, const char *format,...) G_GNUC_PRINTF(7
 
WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_itemproto_tree_add_guid_format (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, const e_guid_t *value_ptr, const char *format,...) G_GNUC_PRINTF(7
 
WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_itemproto_tree_add_oid (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, const guint8 *value_ptr)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_oid_format_value (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, const guint8 *value_ptr, const char *format,...) G_GNUC_PRINTF(7
 
WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_itemproto_tree_add_oid_format (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, const guint8 *value_ptr, const char *format,...) G_GNUC_PRINTF(7
 
WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_itemproto_tree_add_string (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, const char *value)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_string_format_value (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, const char *value, const char *format,...) G_GNUC_PRINTF(7
 
WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_itemproto_tree_add_string_format (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, const char *value, const char *format,...) G_GNUC_PRINTF(7
 
WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_itemproto_tree_add_boolean (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, guint64 value)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_boolean_format_value (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, guint64 value, const char *format,...) G_GNUC_PRINTF(7
 
WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_itemproto_tree_add_boolean_format (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, guint64 value, const char *format,...) G_GNUC_PRINTF(7
 
WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_itemproto_tree_add_float (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, float value)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_float_format_value (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, float value, const char *format,...) G_GNUC_PRINTF(7
 
WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_itemproto_tree_add_float_format (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, float value, const char *format,...) G_GNUC_PRINTF(7
 
WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_itemproto_tree_add_double (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, double value)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_double_format_value (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, double value, const char *format,...) G_GNUC_PRINTF(7
 
WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_itemproto_tree_add_double_format (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, double value, const char *format,...) G_GNUC_PRINTF(7
 
WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_itemproto_tree_add_uint (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, guint32 value)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_uint_format_value (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, guint32 value, const char *format,...) G_GNUC_PRINTF(7
 
WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_itemproto_tree_add_uint_format (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, guint32 value, const char *format,...) G_GNUC_PRINTF(7
 
WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_itemproto_tree_add_uint64 (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, guint64 value)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_uint64_format_value (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, guint64 value, const char *format,...) G_GNUC_PRINTF(7
 
WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_itemproto_tree_add_uint64_format (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, guint64 value, const char *format,...) G_GNUC_PRINTF(7
 
WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_itemproto_tree_add_int (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, gint32 value)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_int_format_value (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, gint32 value, const char *format,...) G_GNUC_PRINTF(7
 
WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_itemproto_tree_add_int_format (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, gint32 value, const char *format,...) G_GNUC_PRINTF(7
 
WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_itemproto_tree_add_int64 (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, gint64 value)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_int64_format_value (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, gint64 value, const char *format,...) G_GNUC_PRINTF(7
 
WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_itemproto_tree_add_int64_format (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, gint64 value, const char *format,...) G_GNUC_PRINTF(7
 
WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_itemproto_tree_add_eui64 (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, const guint64 value)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_eui64_format_value (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, const guint64 value, const char *format,...) G_GNUC_PRINTF(7
 
WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_itemproto_tree_add_eui64_format (proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length, const guint64 value, const char *format,...) G_GNUC_PRINTF(7
 
WS_DLL_PUBLIC proto_itemproto_tree_add_mac48_detail (const mac_hf_list_t *list_specific, const mac_hf_list_t *list_generic, gint idx, tvbuff_t *tvb, proto_tree *tree, gint offset)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_debug_text (proto_tree *tree, const char *format,...) G_GNUC_PRINTF(2
 
WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC void proto_item_fill_label (field_info *finfo, gchar *label_str)
 
WS_DLL_PUBLIC int proto_item_fill_display_label (field_info *fi, gchar *display_label_str, const int label_str_size)
 
WS_DLL_PUBLIC int proto_register_protocol (const char *name, const char *short_name, const char *filter_name)
 
WS_DLL_PUBLIC int proto_register_protocol_in_name_only (const char *name, const char *short_name, const char *filter_name, int parent_proto, enum ftenum field_type)
 
gboolean proto_deregister_protocol (const char *short_name)
 
WS_DLL_PUBLIC void proto_register_alias (const int proto_id, const char *alias_name)
 
WS_DLL_PUBLIC void proto_register_prefix (const char *prefix, prefix_initializer_t initializer)
 
WS_DLL_PUBLIC void proto_initialize_all_prefixes (void)
 
WS_DLL_PUBLIC void proto_register_field_array (const int parent, hf_register_info *hf, const int num_records)
 
WS_DLL_PUBLIC void proto_deregister_field (const int parent, gint hf_id)
 
WS_DLL_PUBLIC void proto_add_deregistered_data (void *data)
 
void proto_add_deregistered_slice (gsize block_size, gpointer mem_block)
 
WS_DLL_PUBLIC void proto_free_field_strings (ftenum_t field_type, unsigned int field_display, const void *field_strings)
 
WS_DLL_PUBLIC void proto_free_deregistered_fields (void)
 
WS_DLL_PUBLIC void proto_register_subtree_array (gint *const *indices, const int num_indices)
 
WS_DLL_PUBLIC const char * proto_registrar_get_name (const int n)
 
WS_DLL_PUBLIC const char * proto_registrar_get_abbrev (const int n)
 
WS_DLL_PUBLIC header_field_infoproto_registrar_get_nth (guint hfindex)
 
WS_DLL_PUBLIC header_field_infoproto_registrar_get_byname (const char *field_name)
 
WS_DLL_PUBLIC header_field_infoproto_registrar_get_byalias (const char *alias_name)
 
WS_DLL_PUBLIC int proto_registrar_get_id_byname (const char *field_name)
 
WS_DLL_PUBLIC enum ftenum proto_registrar_get_ftype (const int n)
 
WS_DLL_PUBLIC int proto_registrar_get_parent (const int n)
 
WS_DLL_PUBLIC gboolean proto_registrar_is_protocol (const int n)
 
gint proto_registrar_get_length (const int n)
 
WS_DLL_PUBLIC int proto_get_first_protocol (void **cookie)
 
WS_DLL_PUBLIC int proto_get_data_protocol (void *cookie)
 
WS_DLL_PUBLIC int proto_get_next_protocol (void **cookie)
 
WS_DLL_PUBLIC header_field_infoproto_get_first_protocol_field (const int proto_id, void **cookie)
 
WS_DLL_PUBLIC header_field_infoproto_get_next_protocol_field (const int proto_id, void **cookie)
 
WS_DLL_PUBLIC int proto_name_already_registered (const gchar *name)
 
WS_DLL_PUBLIC int proto_get_id_by_filter_name (const gchar *filter_name)
 
WS_DLL_PUBLIC int proto_get_id_by_short_name (const gchar *short_name)
 
WS_DLL_PUBLIC gboolean proto_can_toggle_protocol (const int proto_id)
 
WS_DLL_PUBLIC protocol_tfind_protocol_by_id (const int proto_id)
 
WS_DLL_PUBLIC const char * proto_get_protocol_name (const int proto_id)
 
WS_DLL_PUBLIC int proto_get_id (const protocol_t *protocol)
 
WS_DLL_PUBLIC const char * proto_get_protocol_short_name (const protocol_t *protocol)
 
WS_DLL_PUBLIC const char * proto_get_protocol_long_name (const protocol_t *protocol)
 
WS_DLL_PUBLIC gboolean proto_is_protocol_enabled (const protocol_t *protocol)
 
WS_DLL_PUBLIC gboolean proto_is_protocol_enabled_by_default (const protocol_t *protocol)
 
WS_DLL_PUBLIC gboolean proto_is_pino (const protocol_t *protocol)
 
WS_DLL_PUBLIC const char * proto_get_protocol_filter_name (const int proto_id)
 
void proto_add_heuristic_dissector (protocol_t *protocol, const char *short_name)
 
WS_DLL_PUBLIC void proto_heuristic_dissector_foreach (const protocol_t *protocol, GFunc func, gpointer user_data)
 
WS_DLL_PUBLIC void proto_get_frame_protocols (const wmem_list_t *layers, gboolean *is_ip, gboolean *is_tcp, gboolean *is_udp, gboolean *is_sctp, gboolean *is_tls, gboolean *is_rtp, gboolean *is_lte_rlc)
 
WS_DLL_PUBLIC gboolean proto_is_frame_protocol (const wmem_list_t *layers, const char *proto_name)
 
WS_DLL_PUBLIC gchar * proto_list_layers (const packet_info *pinfo)
 
WS_DLL_PUBLIC void proto_disable_by_default (const int proto_id)
 
WS_DLL_PUBLIC void proto_set_decoding (const int proto_id, const gboolean enabled)
 
WS_DLL_PUBLIC void proto_disable_all (void)
 
WS_DLL_PUBLIC void proto_reenable_all (void)
 
WS_DLL_PUBLIC void proto_set_cant_toggle (const int proto_id)
 
gboolean proto_check_for_protocol_or_field (const proto_tree *tree, const int id)
 
WS_DLL_PUBLIC GPtrArray * proto_get_finfo_ptr_array (const proto_tree *tree, const int hfindex)
 
WS_DLL_PUBLIC gboolean proto_tracking_interesting_fields (const proto_tree *tree)
 
WS_DLL_PUBLIC GPtrArray * proto_find_finfo (proto_tree *tree, const int hfindex)
 
WS_DLL_PUBLIC GPtrArray * proto_find_first_finfo (proto_tree *tree, const int hfindex)
 
WS_DLL_PUBLIC GPtrArray * proto_all_finfos (proto_tree *tree)
 
WS_DLL_PUBLIC void proto_registrar_dump_protocols (void)
 
WS_DLL_PUBLIC void proto_registrar_dump_values (void)
 
WS_DLL_PUBLIC void proto_registrar_dump_elastic (const gchar *filter)
 
WS_DLL_PUBLIC gboolean proto_registrar_dump_fieldcount (void)
 
WS_DLL_PUBLIC void proto_registrar_dump_fields (void)
 
WS_DLL_PUBLIC gboolean proto_registrar_dump_field_completions (char *prefix)
 
WS_DLL_PUBLIC void proto_registrar_dump_ftypes (void)
 
WS_DLL_PUBLIC const char * proto_field_display_to_string (int field_display)
 
WS_DLL_PUBLIC gboolean tree_expanded (int tree_type)
 
WS_DLL_PUBLIC void tree_expanded_set (int tree_type, gboolean value)
 
WS_DLL_PUBLIC int hfinfo_bitshift (const header_field_info *hfinfo)
 
WS_DLL_PUBLIC gboolean proto_can_match_selected (field_info *finfo, struct epan_dissect *edt)
 
WS_DLL_PUBLIC char * proto_construct_match_selected_string (field_info *finfo, struct epan_dissect *edt)
 
WS_DLL_PUBLIC field_infoproto_find_field_from_offset (proto_tree *tree, guint offset, tvbuff_t *tvb)
 
WS_DLL_PUBLIC gchar * proto_find_undecoded_data (proto_tree *tree, guint length)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_bitmask (proto_tree *tree, tvbuff_t *tvb, const guint offset, const int hf_hdr, const gint ett, int *const *fields, const guint encoding)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_bitmask_ret_uint64 (proto_tree *tree, tvbuff_t *tvb, const guint offset, const int hf_hdr, const gint ett, int *const *fields, const guint encoding, guint64 *retval)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_bitmask_with_flags (proto_tree *tree, tvbuff_t *tvb, const guint offset, const int hf_hdr, const gint ett, int *const *fields, const guint encoding, const int flags)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_bitmask_with_flags_ret_uint64 (proto_tree *tree, tvbuff_t *tvb, const guint offset, const int hf_hdr, const gint ett, int *const *fields, const guint encoding, const int flags, guint64 *retval)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_bitmask_value (proto_tree *tree, tvbuff_t *tvb, const guint offset, const int hf_hdr, const gint ett, int *const *fields, const guint64 value)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_bitmask_value_with_flags (proto_tree *tree, tvbuff_t *tvb, const guint offset, const int hf_hdr, const gint ett, int *const *fields, const guint64 value, const int flags)
 
WS_DLL_PUBLIC void proto_tree_add_bitmask_list (proto_tree *tree, tvbuff_t *tvb, const guint offset, const int len, int *const *fields, const guint encoding)
 
WS_DLL_PUBLIC void proto_tree_add_bitmask_list_ret_uint64 (proto_tree *tree, tvbuff_t *tvb, const guint offset, const int len, int *const *fields, const guint encoding, guint64 *retval)
 
WS_DLL_PUBLIC void proto_tree_add_bitmask_list_value (proto_tree *tree, tvbuff_t *tvb, const guint offset, const int len, int *const *fields, const guint64 value)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_bitmask_len (proto_tree *tree, tvbuff_t *tvb, const guint offset, const guint len, const int hf_hdr, const gint ett, int *const *fields, struct expert_field *exp, const guint encoding)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_bitmask_text (proto_tree *tree, tvbuff_t *tvb, const guint offset, const guint len, const char *name, const char *fallback, const gint ett, int *const *fields, const guint encoding, const int flags)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_bits_item (proto_tree *tree, const int hf_index, tvbuff_t *tvb, const guint bit_offset, const gint no_of_bits, const guint encoding)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_split_bits_item_ret_val (proto_tree *tree, const int hf_index, tvbuff_t *tvb, const guint bit_offset, const crumb_spec_t *crumb_spec, guint64 *return_value)
 
void proto_tree_add_split_bits_crumb (proto_tree *tree, const int hf_index, tvbuff_t *tvb, const guint bit_offset, const crumb_spec_t *crumb_spec, guint16 crumb_index)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_bits_ret_val (proto_tree *tree, const int hf_index, tvbuff_t *tvb, const guint bit_offset, const gint no_of_bits, guint64 *return_value, const guint encoding)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_uint_bits_format_value (proto_tree *tree, const int hf_index, tvbuff_t *tvb, const guint bit_offset, const gint no_of_bits, guint32 value, const guint encoding, const char *format,...) G_GNUC_PRINTF(8
 
WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_itemproto_tree_add_uint64_bits_format_value (proto_tree *tree, const int hf_index, tvbuff_t *tvb, const guint bit_offset, const gint no_of_bits, guint64 value, const guint encoding, const char *format,...) G_GNUC_PRINTF(8
 
WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item proto_itemproto_tree_add_boolean_bits_format_value (proto_tree *tree, const int hf_index, tvbuff_t *tvb, const guint bit_offset, const gint no_of_bits, guint64 value, const guint encoding, const char *format,...) G_GNUC_PRINTF(8
 
WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item proto_item proto_itemproto_tree_add_int_bits_format_value (proto_tree *tree, const int hf_index, tvbuff_t *tvb, const guint bit_offset, const gint no_of_bits, gint32 value, const guint encoding, const char *format,...) G_GNUC_PRINTF(8
 
WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item proto_item proto_item proto_itemproto_tree_add_int64_bits_format_value (proto_tree *tree, const int hf_index, tvbuff_t *tvb, const guint bit_offset, const gint no_of_bits, gint64 value, const guint encoding, const char *format,...) G_GNUC_PRINTF(8
 
WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item proto_item proto_item proto_item proto_itemproto_tree_add_float_bits_format_value (proto_tree *tree, const int hf_index, tvbuff_t *tvb, const guint bit_offset, const gint no_of_bits, float value, const guint encoding, const char *format,...) G_GNUC_PRINTF(8
 
WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item proto_item proto_item proto_item proto_item WS_DLL_PUBLIC proto_itemproto_tree_add_ts_23_038_7bits_packed_item (proto_tree *tree, const int hfindex, tvbuff_t *tvb, const guint bit_offset, const gint no_of_chars)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_ascii_7bits_item (proto_tree *tree, const int hfindex, tvbuff_t *tvb, const guint bit_offset, const gint no_of_chars)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_checksum (proto_tree *tree, tvbuff_t *tvb, const guint offset, const int hf_checksum, const int hf_checksum_status, struct expert_field *bad_checksum_expert, packet_info *pinfo, guint32 computed_checksum, const guint encoding, const guint flags)
 
WS_DLL_PUBLIC proto_itemproto_tree_add_checksum_bytes (proto_tree *tree, tvbuff_t *tvb, const guint offset, const int hf_checksum, const int hf_checksum_status, struct expert_field *bad_checksum_expert, packet_info *pinfo, const uint8_t *computed_checksum, size_t checksum_len, const guint flags)
 
WS_DLL_PUBLIC guchar proto_check_field_name (const gchar *field_name)
 
WS_DLL_PUBLIC guchar proto_check_field_name_lower (const gchar *field_name)
 
const gchar * proto_custom_set (proto_tree *tree, GSList *field_id, gint occurrence, gchar *result, gchar *expr, const int size)
 
gchar * proto_custom_get_filter (struct epan_dissect *edt, GSList *field_id, gint occurrence)
 

Variables

WS_DLL_PUBLIC int hf_text_only
 
WS_DLL_PUBLIC int num_tree_types
 
WS_DLL_PUBLIC const value_string proto_checksum_vals []
 

Detailed Description

Dissectors use proto_tree_add_* to add items to the protocol tree. In most cases you'll want to use proto_tree_add_item().

Macro Definition Documentation

◆ __DISSECTOR_ASSERT

#define __DISSECTOR_ASSERT (   expression,
  file,
  lineno 
)
Value:
(REPORT_DISSECTOR_BUG("%s:%u: failed assertion \"%s\"", \
file, lineno, __DISSECTOR_ASSERT_STRINGIFY(expression)))
#define __DISSECTOR_ASSERT_STRINGIFY(s)
Definition: proto.h:146

◆ __DISSECTOR_ASSERT_CMPINT

#define __DISSECTOR_ASSERT_CMPINT (   a,
  op,
  b,
  type,
  fmt 
)
Value:
(REPORT_DISSECTOR_BUG("%s:%u: failed assertion " #a " " #op " " #b " (" fmt " " #op " " fmt ")", \
__FILE__, __LINE__, (type)a, (type)b))

Compare two integers.

This is functionally the same as DISSECTOR_ASSERT(a op b) except that it will display the values of a and b upon failure.

DISSECTOR_ASSERT_CMPINT(a, ==, b);
DISSECTOR_ASSERT_CMPINT(min, <=, max);

This function can currently compare values that fit inside a gint64.

WARNING: The number of times the arguments are evaluated is undefined. Do not use expressions with side effects as arguments.

Parameters
aThe first integer.
opAny binary operator.
bThe second integer.
typethe type operator
fmtthe fmt operator

◆ __DISSECTOR_ASSERT_FIELD_TYPE

#define __DISSECTOR_ASSERT_FIELD_TYPE (   hfinfo,
 
)
Value:
(REPORT_DISSECTOR_BUG("%s:%u: field %s is not of type "#t, \
__FILE__, __LINE__, (hfinfo)->abbrev))

◆ __DISSECTOR_ASSERT_FIELD_TYPE_IS_STRING

#define __DISSECTOR_ASSERT_FIELD_TYPE_IS_STRING (   hfinfo)
Value:
(REPORT_DISSECTOR_BUG("%s:%u: field %s is not of type FT_STRING, FT_STRINGZ, FT_STRINGZPAD, FT_STRINGZTRUNC, or FT_UINT_STRING", \
__FILE__, __LINE__, (hfinfo)->abbrev))

◆ __DISSECTOR_ASSERT_FIELD_TYPE_IS_TIME

#define __DISSECTOR_ASSERT_FIELD_TYPE_IS_TIME (   hfinfo)
Value:
(REPORT_DISSECTOR_BUG("%s:%u: field %s is not of type FT_ABSOLUTE_TIME or FT_RELATIVE_TIME", \
__FILE__, __LINE__, (hfinfo)->abbrev))

◆ __DISSECTOR_ASSERT_HINT

#define __DISSECTOR_ASSERT_HINT (   expression,
  file,
  lineno,
  hint 
)
Value:
(REPORT_DISSECTOR_BUG("%s:%u: failed assertion \"%s\" (%s)", \
file, lineno, __DISSECTOR_ASSERT_STRINGIFY(expression), hint))

◆ __DISSECTOR_ASSERT_STATIC_ANALYSIS_HINT

#define __DISSECTOR_ASSERT_STATIC_ANALYSIS_HINT (   expression)

Macro used to provide a hint to static analysis tools. (Currently only Visual C++.)

◆ __DISSECTOR_ASSERT_STRINGIFY

#define __DISSECTOR_ASSERT_STRINGIFY (   s)    # s

Macro used for assertions in dissectors; it doesn't abort, it just throws a DissectorError exception, with the assertion failure message as a parameter, so that it can show up in the protocol tree.

NOTE: this should only be used to detect bugs in the dissector (e.g., logic conditions that shouldn't happen). It should NOT be used for showing that a packet is malformed. For that, use expert_infos instead.

Parameters
sexpression to test in the assertion

◆ BASE_ALLOW_ZERO

#define BASE_ALLOW_ZERO   0x00000800

Display <none> instead of <MISSING> for zero sized byte array

◆ BASE_NO_DISPLAY_VALUE

#define BASE_NO_DISPLAY_VALUE   0x00002000

Just display the field name with no value. Intended for byte arrays or header fields above a subtree

◆ BASE_PROTOCOL_INFO

#define BASE_PROTOCOL_INFO   0x00004000

protocol_t in [FIELDCONVERT]. Internal use only.

◆ BASE_RANGE_STRING

#define BASE_RANGE_STRING   0x00000100

Use the supplied range string to convert the field to text

◆ BASE_SHOW_ASCII_PRINTABLE

#define BASE_SHOW_ASCII_PRINTABLE   0x00010000

show byte array as ASCII if it's all printable characters

◆ BASE_SHOW_UTF_8_PRINTABLE

#define BASE_SHOW_UTF_8_PRINTABLE   0x00020000

show byte array as UTF-8 if it's all valid and printable UTF-8 characters

◆ BASE_SPECIAL_VALS

#define BASE_SPECIAL_VALS   0x00008000

field will not display "Unknown" if value_string match is not found

◆ BASE_UNIT_STRING

#define BASE_UNIT_STRING   0x00001000

Add unit text to the field value

◆ BMT_NO_APPEND

#define BMT_NO_APPEND   0x01

Don't change the title at all

◆ BMT_NO_FALSE

#define BMT_NO_FALSE   0x04

Don't add booleans unless they're TRUE

◆ BMT_NO_FLAGS

#define BMT_NO_FLAGS   0x00

Don't use any flags

◆ BMT_NO_INT

#define BMT_NO_INT   0x02

Don't add integral (non-boolean) fields to title

◆ BMT_NO_TFS

#define BMT_NO_TFS   0x08

Don't use true_false_string while formatting booleans

◆ CF_FUNC

#define CF_FUNC (   x)    ((const void *) (gsize) (x))

Make a custom format function pointer look like a void pointer. Used to set header_field_info.strings.

We cast to gsize first, which 1) is guaranteed to be wide enough to hold a pointer and 2) lets us side-step warnings about casting function pointers to 'void *'. This violates ISO C but should be fine on POSIX and Windows.

◆ DISSECTOR_ASSERT

#define DISSECTOR_ASSERT (   expression)
Value:
((void) ((expression) ? (void)0 : \
__DISSECTOR_ASSERT (expression, __FILE__, __LINE__))) \
__DISSECTOR_ASSERT_STATIC_ANALYSIS_HINT(expression)

◆ DISSECTOR_ASSERT_CMPINT

#define DISSECTOR_ASSERT_CMPINT (   a,
  op,
 
)
Value:
((void) ((a op b) ? (void)0 : \
__DISSECTOR_ASSERT_CMPINT (a, op, b, int64_t, "%" PRId64))) \
__DISSECTOR_ASSERT_STATIC_ANALYSIS_HINT(a op b)
#define __DISSECTOR_ASSERT_CMPINT(a, op, b, type, fmt)
Definition: proto.h:211

◆ DISSECTOR_ASSERT_CMPUINT

#define DISSECTOR_ASSERT_CMPUINT (   a,
  op,
 
)
Value:
((void) ((a op b) ? (void)0 : \
__DISSECTOR_ASSERT_CMPINT (a, op, b, uint64_t, "%" PRIu64))) \
__DISSECTOR_ASSERT_STATIC_ANALYSIS_HINT(a op b)

Like DISSECTOR_ASSERT_CMPINT() except the arguments are treated as unsigned values.

This function can currently compare values that fit inside a guint64.

◆ DISSECTOR_ASSERT_CMPUINTHEX

#define DISSECTOR_ASSERT_CMPUINTHEX (   a,
  op,
 
)
Value:
((void) ((a op b) ? (void)0 : \
__DISSECTOR_ASSERT_CMPINT (a, op, b, uint64_t, "0x%" PRIX64))) \
__DISSECTOR_ASSERT_STATIC_ANALYSIS_HINT(a op b)

Like DISSECTOR_ASSERT_CMPUINT() except the values are displayed in hexadecimal upon assertion failure.

◆ DISSECTOR_ASSERT_FIELD_TYPE

#define DISSECTOR_ASSERT_FIELD_TYPE (   hfinfo,
 
)
Value:
((void) (((hfinfo)->type == t) ? (void)0 : \
__DISSECTOR_ASSERT_FIELD_TYPE ((hfinfo), t))) \
#define __DISSECTOR_ASSERT_STATIC_ANALYSIS_HINT(expression)
Definition: proto.h:132

◆ DISSECTOR_ASSERT_FIELD_TYPE_IS_INTEGRAL

#define DISSECTOR_ASSERT_FIELD_TYPE_IS_INTEGRAL (   hfinfo)
Value:
((void) ((FT_IS_INTEGER((hfinfo)->type)) ? (void)0 : \
REPORT_DISSECTOR_BUG("%s:%u: field %s is not of type FT_CHAR or an FT_{U}INTn type", \
__FILE__, __LINE__, (hfinfo)->abbrev))) \
__DISSECTOR_ASSERT_STATIC_ANALYSIS_HINT(FT_IS_INTEGER((hfinfo)->type))

◆ DISSECTOR_ASSERT_FIELD_TYPE_IS_STRING

#define DISSECTOR_ASSERT_FIELD_TYPE_IS_STRING (   hfinfo)
Value:
((void) (FT_IS_STRING((hfinfo)->type) ? (void)0 : \
__DISSECTOR_ASSERT_FIELD_TYPE_IS_STRING ((hfinfo)))) \
__DISSECTOR_ASSERT_STATIC_ANALYSIS_HINT(FT_IS_STRING((hfinfo)->type))

◆ DISSECTOR_ASSERT_FIELD_TYPE_IS_TIME

#define DISSECTOR_ASSERT_FIELD_TYPE_IS_TIME (   hfinfo)
Value:
((void) (((hfinfo)->type == FT_ABSOLUTE_TIME || \
(hfinfo)->type == FT_RELATIVE_TIME) ? (void)0 : \
__DISSECTOR_ASSERT_FIELD_TYPE_IS_TIME ((hfinfo)))) \
__DISSECTOR_ASSERT_STATIC_ANALYSIS_HINT((hfinfo)->type == FT_ABSOLUTE_TIME || \
(hfinfo)->type == FT_RELATIVE_TIME)

◆ DISSECTOR_ASSERT_HINT

#define DISSECTOR_ASSERT_HINT (   expression,
  hint 
)
Value:
((void) ((expression) ? (void)0 : \
__DISSECTOR_ASSERT_HINT (expression, __FILE__, __LINE__, hint))) \
__DISSECTOR_ASSERT_STATIC_ANALYSIS_HINT(expression)

Same as DISSECTOR_ASSERT(), but takes an extra 'hint' parameter that can be used to provide information as to why the assertion might fail.

Parameters
expressionexpression to test in the assertion
hintmessage providing extra information

◆ DISSECTOR_ASSERT_NOT_REACHED

#define DISSECTOR_ASSERT_NOT_REACHED ( )
Value:
(REPORT_DISSECTOR_BUG("%s:%u: failed assertion \"DISSECTOR_ASSERT_NOT_REACHED\"", \
__FILE__, __LINE__))

Same as DISSECTOR_ASSERT(), but will throw DissectorError exception unconditionally, much like GLIB's g_assert_not_reached works.

NOTE: this should only be used to detect bugs in the dissector (e.g., logic conditions that shouldn't happen). It should NOT be used for showing that a packet is malformed. For that, use expert_infos instead.

◆ FI_BIG_ENDIAN

#define FI_BIG_ENDIAN   0x00000010

The protocol field value is in big endian

◆ FI_BITS_OFFSET

#define FI_BITS_OFFSET (   n)    (((n) & 7) << 5)

Field value start from nth bit (values from 0x20 - 0x100)

◆ FI_BITS_SIZE

#define FI_BITS_SIZE (   n)    (((n) & 63) << 8)

Field value takes n bits (values from 0x100 - 0x4000)

◆ FI_GENERATED

#define FI_GENERATED   0x00000002

The protocol field should be displayed as "generated by Wireshark", used in field_info.flags.

◆ FI_GET_FLAG

#define FI_GET_FLAG (   fi,
  flag 
)    ((fi) ? ((fi)->flags & (flag)) : 0)

convenience macro to get field_info.flags

◆ FI_HIDDEN

#define FI_HIDDEN   0x00000001

The protocol field should not be shown in the tree (it's used for filtering only), used in field_info.flags. HIDING PROTOCOL FIELDS IS DEPRECATED, IT'S CONSIDERED TO BE BAD GUI DESIGN! A user cannot tell by looking at the packet detail that the field exists and that they can filter on its value.

◆ FI_LITTLE_ENDIAN

#define FI_LITTLE_ENDIAN   0x00000008

The protocol field value is in little endian

◆ FI_RESET_FLAG

#define FI_RESET_FLAG (   fi,
  flag 
)
Value:
do { \
if (fi) \
(fi)->flags = (fi)->flags & ~(flag); \
} while(0)

convenience macro to reset field_info.flags

◆ FI_SET_FLAG

#define FI_SET_FLAG (   fi,
  flag 
)
Value:
do { \
if (fi) \
(fi)->flags = (fi)->flags | (flag); \
} while(0)

convenience macro to set field_info.flags

◆ FI_URL

#define FI_URL   0x00000004

The protocol field is actually a URL

◆ FI_VARINT

#define FI_VARINT   0x00004000

The protocol field value is a varint

◆ FIELD_DISPLAY_E_MASK

#define FIELD_DISPLAY_E_MASK   0xFF

FIELD_DISPLAY_E_MASK selects the field_display_e value.

◆ FRAMENUM_TYPE

#define FRAMENUM_TYPE (   x)    GINT_TO_POINTER(x)

Cast a ft_framenum_type_t, used to set header_field_info.strings

◆ g_ptr_array_len

#define g_ptr_array_len (   a)    ((a)?(a)->len:0)

glib doesn't have g_ptr_array_len of all things!

◆ HFILL

#define HFILL   -1, 0, HF_REF_TYPE_NONE, -1, NULL

HFILL initializes all the "set by proto routines" fields in a _header_field_info. If new fields are added or removed, it should be changed as necessary.

◆ HFILL_INIT

#define HFILL_INIT (   hf)
Value:
(hf).hfinfo.id = -1; \
(hf).hfinfo.parent = 0; \
(hf).hfinfo.ref_type = HF_REF_TYPE_NONE; \
(hf).hfinfo.same_name_prev_id = -1; \
(hf).hfinfo.same_name_next = NULL;
@ HF_REF_TYPE_NONE
Definition: proto.h:753

◆ IS_BASE_DUAL

#define IS_BASE_DUAL (   b)    ((b)==BASE_DEC_HEX||(b)==BASE_HEX_DEC)

BASE_ values that cause the field value to be displayed twice

◆ IS_BASE_PORT

#define IS_BASE_PORT (   b)    (((b)==BASE_PT_UDP||(b)==BASE_PT_TCP||(b)==BASE_PT_DCCP||(b)==BASE_PT_SCTP))

BASE_PT_ values display decimal and transport port service name

◆ ITEM_LABEL_LENGTH

#define ITEM_LABEL_LENGTH   240

the maximum length of a protocol field string representation

◆ PI_ASSUMPTION

#define PI_ASSUMPTION   0x0d000000

The protocol field has incomplete data, decode based on assumed value

◆ PI_CHAT

#define PI_CHAT   0x00200000

Usual workflow, e.g. TCP connection establishing

◆ PI_CHECKSUM

#define PI_CHECKSUM   0x01000000

The protocol field has a bad checksum, usually uses PI_WARN severity

◆ PI_COMMENT

#define PI_COMMENT   0x00100000

Packet comment

◆ PI_COMMENTS_GROUP

#define PI_COMMENTS_GROUP   0x0b000000

The protocol field indicates a packet comment

◆ PI_DEBUG

#define PI_DEBUG   0x08000000

A generic debugging message (shouldn't remain in production code!), usually PI_ERROR severity

◆ PI_DECRYPTION

#define PI_DECRYPTION   0x0c000000

The protocol field indicates a decryption problem

◆ PI_DEPRECATED

#define PI_DEPRECATED   0x0e000000

The protocol field has been deprecated, usually PI_NOTE severity

◆ PI_ERROR

#define PI_ERROR   0x00800000

Serious problems, e.g. a malformed packet

◆ PI_GROUP_MASK

#define PI_GROUP_MASK   0xFF000000

mask usually for internal use only!

◆ PI_INTERFACE

#define PI_INTERFACE   0x10000000

Something happened at the interface layer (out of buffers, hardware error, etc.)

◆ PI_MALFORMED

#define PI_MALFORMED   0x07000000

The packet data is malformed, the dissector has "given up", usually PI_ERROR severity

◆ PI_NOTE

#define PI_NOTE   0x00400000

Notable messages, e.g. an application returned an "unusual" error code like HTTP 404

◆ PI_PROTOCOL

#define PI_PROTOCOL   0x09000000

The protocol field violates a protocol specification, usually PI_WARN severity

◆ PI_REASSEMBLE

#define PI_REASSEMBLE   0x06000000

The protocol field indicates a reassemble (e.g. DCE/RPC defragmentation), usually PI_CHAT severity (or PI_ERROR)

◆ PI_RECEIVE

#define PI_RECEIVE   0x0f000000

Something happened as part of the receive process (CRC error, short/long frame, etc.)

◆ PI_REQUEST_CODE

#define PI_REQUEST_CODE   0x04000000

The protocol field indicates an application request (e.g. File Handle == xxxx), usually PI_CHAT severity

◆ PI_RESPONSE_CODE

#define PI_RESPONSE_CODE   0x03000000

The protocol field indicates a bad application response code (e.g. HTTP 404), usually PI_NOTE severity

◆ PI_SECURITY

#define PI_SECURITY   0x0a000000

The protocol field indicates a security problem (e.g. insecure implementation)

◆ PI_SEQUENCE

#define PI_SEQUENCE   0x02000000

The protocol field indicates a sequence problem (e.g. TCP window is zero)

◆ PI_SEVERITY_MASK

#define PI_SEVERITY_MASK   0x00F00000

mask usually for internal use only!

◆ PI_UNDECODED

#define PI_UNDECODED   0x05000000

The data is undecoded, the protocol dissection is incomplete here, usually PI_WARN severity

◆ PI_WARN

#define PI_WARN   0x00600000

Warning, e.g. application returned an "unusual" error code

◆ PITEM_FINFO

#define PITEM_FINFO (   proto_item)    PNODE_FINFO(proto_item)

Retrieve the field_info from a proto_item

◆ PNODE_FINFO

#define PNODE_FINFO (   proto_node)    ((proto_node)->finfo)

Retrieve the field_info from a proto_node

◆ PNODE_POOL

#define PNODE_POOL (   proto_node)    ((proto_node)->tree_data->pinfo->pool)

Retrieve the wmem_allocator_t from a proto_node

◆ PROTO_CHECKSUM_GENERATED

#define PROTO_CHECKSUM_GENERATED   0x02

Checksum is generated only

◆ PROTO_CHECKSUM_IN_CKSUM

#define PROTO_CHECKSUM_IN_CKSUM   0x04

Internet checksum routine used for computation

◆ PROTO_CHECKSUM_NO_FLAGS

#define PROTO_CHECKSUM_NO_FLAGS   0x00

Don't use any flags

◆ PROTO_CHECKSUM_NOT_PRESENT

#define PROTO_CHECKSUM_NOT_PRESENT   0x10

Checksum field is not present (Just populates status field)

◆ PROTO_CHECKSUM_VERIFY

#define PROTO_CHECKSUM_VERIFY   0x01

Compare against computed checksum

◆ PROTO_CHECKSUM_ZERO

#define PROTO_CHECKSUM_ZERO   0x08

Computed checksum must be zero (but correct checksum can't be calculated)

◆ PTREE_DATA

#define PTREE_DATA (   proto_tree)    ((proto_tree)->tree_data)

Retrieve the tree_data_t from a proto_tree

◆ PTREE_FINFO

#define PTREE_FINFO (   proto_tree)    PNODE_FINFO(proto_tree)

Retrieve the field_info from a proto_tree

◆ RVALS

#define RVALS (   x)    (cast_same(const struct _range_string*, (x)))

Make a const range_string[] look like a _range_string pointer, used to set header_field_info.strings

◆ TFS

#define TFS (   x)    (cast_same(const struct true_false_string*, (x)))

Make a const true_false_string[] look like a _true_false_string pointer, used to set header_field_info.strings

◆ VALS

#define VALS (   x)    (cast_same(const struct _value_string*, (x)))

Make a const value_string[] look like a _value_string pointer, used to set header_field_info.strings

◆ VALS64

#define VALS64 (   x)    (cast_same(const struct _val64_string*, (x)))

Make a const val64_string[] look like a _val64_string pointer, used to set header_field_info.strings

◆ VALS_EXT_PTR

#define VALS_EXT_PTR (   x)    (cast_same(value_string_ext*, (x)))

Something to satisfy checkAPIs when you have a pointer to a value_string_ext (e.g., one built with value_string_ext_new())

Typedef Documentation

◆ field_info

typedef struct field_info field_info

Contains the field information for the proto_item.

◆ header_field_info

information describing a header field

◆ hf_register_info

Used when registering many fields at once, using proto_register_field_array()

◆ item_label_t

typedef struct _item_label_t item_label_t

string representation, if one of the proto_tree_add_..._format() functions used

◆ mac_hf_list_t

typedef WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item struct _mac_hf_list_t mac_hf_list_t

Structure used in proto_tree_add_mac48_detail below

◆ prefix_initializer_t

typedef void(* prefix_initializer_t) (const char *match)

This type of function can be registered to get called whenever a given field was not found but a its prefix is matched; It can be used to procrastinate the hf array registration.

Parameters
matchwhat's being matched

◆ proto_item

A protocol item element.

◆ proto_node

typedef struct _proto_node proto_node

Each proto_tree, proto_item is one of these.

◆ proto_tree

A protocol tree element.

◆ protocol_t

typedef struct _protocol protocol_t

Structure for information about a protocol

Enumeration Type Documentation

◆ field_display_e

Enumerator
BASE_NONE 

none

BASE_DEC 

decimal [integer, float]

BASE_HEX 

hexadecimal [integer, float]

BASE_OCT 

octal [integer]

BASE_DEC_HEX 

decimal (hexadecimal) [integer]

BASE_HEX_DEC 

hexadecimal (decimal) [integer]

BASE_CUSTOM 

call custom routine to format [integer, float]

BASE_EXP 

exponential [float]

SEP_DOT 

hexadecimal bytes with a period (.) between each byte

SEP_DASH 

hexadecimal bytes with a dash (-) between each byte

SEP_COLON 

hexadecimal bytes with a colon (:) between each byte

SEP_SPACE 

hexadecimal bytes with a space between each byte

BASE_NETMASK 

Used for IPv4 address that shouldn't be resolved (like for netmasks)

BASE_PT_UDP 

UDP port

BASE_PT_TCP 

TCP port

BASE_PT_DCCP 

DCCP port

BASE_PT_SCTP 

SCTP port

BASE_OUI 

OUI resolution

ABSOLUTE_TIME_LOCAL 

local time in our time zone, with month and day

ABSOLUTE_TIME_UTC 

UTC, with month and day

ABSOLUTE_TIME_DOY_UTC 

UTC, with 1-origin day-of-year

ABSOLUTE_TIME_NTP_UTC 

UTC, with "NULL" when timestamp is all zeros

ABSOLUTE_TIME_UNIX 

Unix time

BASE_STR_WSP 

Replace all whitespace characters (newline, formfeed, etc) with "space".

◆ hf_ref_type

Enumerator
HF_REF_TYPE_NONE 

Field is not referenced

HF_REF_TYPE_INDIRECT 

Field is indirectly referenced (only applicable for FT_PROTOCOL) via. its child

HF_REF_TYPE_DIRECT 

Field is directly referenced

HF_REF_TYPE_PRINT 

Field is directly referenced for printing (so don't fake its representation either)

Function Documentation

◆ find_protocol_by_id()

WS_DLL_PUBLIC protocol_t* find_protocol_by_id ( const int  proto_id)

Get the "protocol_t" structure for the given protocol's item number.

Parameters
proto_idprotocol id (0-indexed)

◆ proto_add_deregistered_data()

WS_DLL_PUBLIC void proto_add_deregistered_data ( void *  data)

Add data to be freed when deregistered fields are freed.

Parameters
dataa pointer to data to free

◆ proto_add_deregistered_slice()

void proto_add_deregistered_slice ( gsize  block_size,
gpointer  mem_block 
)

Add a memory slice to be freed when deregistered fields are freed.

Parameters
block_sizethe size of the block
mem_blocka pointer to the block to free

◆ proto_add_heuristic_dissector()

void proto_add_heuristic_dissector ( protocol_t protocol,
const char *  short_name 
)

Associate a heuristic dissector with a protocol INTERNAL USE ONLY!!!

Parameters
protocolto associate the heuristic with
short_nameheuristic dissector's short name

◆ proto_all_finfos()

WS_DLL_PUBLIC GPtrArray* proto_all_finfos ( proto_tree tree)

Return GPtrArray* of field_info pointers containg all hfindexes that appear in tree.

Parameters
treetree of interest
Returns
GPtrArry pointer

◆ proto_can_match_selected()

WS_DLL_PUBLIC gboolean proto_can_match_selected ( field_info finfo,
struct epan_dissect edt 
)

Can we do a "match selected" on this field.

Parameters
finfofield_info
edtepan dissecting
Returns
TRUE if we can do a "match selected" on the field, FALSE otherwise.

◆ proto_can_toggle_protocol()

WS_DLL_PUBLIC gboolean proto_can_toggle_protocol ( const int  proto_id)

Can item # n decoding be disabled?

Parameters
proto_idprotocol id (0-indexed)
Returns
TRUE if it's a protocol, FALSE if it's not

◆ proto_check_field_name()

WS_DLL_PUBLIC guchar proto_check_field_name ( const gchar *  field_name)

Check if given string is a valid field name

Parameters
field_namethe field name to check
Returns
0 if valid, else first illegal character

◆ proto_check_field_name_lower()

WS_DLL_PUBLIC guchar proto_check_field_name_lower ( const gchar *  field_name)

Check if given string is a valid field name. Accepts only lower case characters.

Parameters
field_namethe field name to check
Returns
0 if valid, else first illegal character

◆ proto_check_for_protocol_or_field()

gboolean proto_check_for_protocol_or_field ( const proto_tree tree,
const int  id 
)

Checks for existence any protocol or field within a tree.

Parameters
tree"Protocols" are assumed to be a child of the [empty] root node.
idhfindex of protocol or field
Returns
TRUE = found, FALSE = not found
Todo:
add explanation of id parameter

◆ proto_cleanup()

void proto_cleanup ( void  )

Frees memory used by proto routines. Called at program shutdown

◆ proto_construct_match_selected_string()

WS_DLL_PUBLIC char* proto_construct_match_selected_string ( field_info finfo,
struct epan_dissect edt 
)

Construct a "match selected" display filter string.

Parameters
finfofield_info
edtepan dissecting
Returns
the wmem NULL alloced display filter string. Needs to be freed with wmem_free(NULL, ...)

◆ proto_custom_get_filter()

gchar* proto_custom_get_filter ( struct epan_dissect edt,
GSList *  field_id,
gint  occurrence 
)

Construct a display filter string for a custom column

Parameters
edtepan dissecting
field_idthe field ids used for custom column
occurrencethe occurrence of the field used for custom column
Returns
allocated display filter string. Needs to be freed with g_free(...)

◆ proto_custom_set()

const gchar* proto_custom_set ( proto_tree tree,
GSList *  field_id,
gint  occurrence,
gchar *  result,
gchar *  expr,
const int  size 
)

Set the column text for a custom column

Parameters
treethe tree to append this item to
field_idthe field ids used for custom column
occurrencethe occurrence of the field used for custom column
resultthe buffer to fill with the field string
exprthe filter expression
sizethe size of the string buffer

◆ proto_deregister_field()

WS_DLL_PUBLIC void proto_deregister_field ( const int  parent,
gint  hf_id 
)

Deregister an already registered field.

Parameters
parentthe protocol handle from proto_register_protocol()
hf_idthe field to deregister

◆ proto_deregister_protocol()

gboolean proto_deregister_protocol ( const char *  short_name)

Deregister a protocol. This is only used internally for reloading Lua plugins and must not be used by dissectors or plugins.

Parameters
short_nameabbreviated name of the protocol
Returns
TRUE if protocol is removed

◆ proto_disable_all()

WS_DLL_PUBLIC void proto_disable_all ( void  )

Disable all protocols.

◆ proto_disable_by_default()

WS_DLL_PUBLIC void proto_disable_by_default ( const int  proto_id)

Mark protocol with the given item number as disabled by default.

Parameters
proto_idprotocol id (0-indexed)

◆ proto_field_display_to_string()

WS_DLL_PUBLIC const char* proto_field_display_to_string ( int  field_display)

Get string representation of display field value

Parameters
field_displayfield display value (one of BASE_ values)
Returns
string representation of display field value or "Unknown" if doesn't exist

◆ proto_field_is_referenced()

WS_DLL_PUBLIC gboolean proto_field_is_referenced ( proto_tree tree,
int  proto_id 
)

This function takes a tree and a protocol id as parameter and will return TRUE/FALSE for whether the protocol or any of the filterable fields in the protocol is referenced by any filters. If this function returns FALSE then it is safe to skip any proto_tree_add_...() calls and just treat the call as if the dissector was called with tree==NULL. If you reset the tree to NULL by this dissector returning FALSE, you will still need to call any subdissector with the original value of tree or filtering will break.

The purpose of this is to optimize wireshark for speed and make it faster for when filters are being used.

◆ proto_find_field_from_offset()

WS_DLL_PUBLIC field_info* proto_find_field_from_offset ( proto_tree tree,
guint  offset,
tvbuff_t tvb 
)

Find field from offset in tvb.

Parameters
treetree of interest
offsetoffset in the tvb
tvbthe tv buffer
Returns
the corresponding field_info

◆ proto_find_finfo()

WS_DLL_PUBLIC GPtrArray* proto_find_finfo ( proto_tree tree,
const int  hfindex 
)

Return GPtrArray* of field_info pointers for all hfindex that appear in tree. Works with any tree, primed or unprimed, and is slower than proto_get_finfo_ptr_array because it has to search through the tree.

Parameters
treetree of interest
hfindexindex of field info of interest
Returns
GPtrArry pointer

◆ proto_find_first_finfo()

WS_DLL_PUBLIC GPtrArray* proto_find_first_finfo ( proto_tree tree,
const int  hfindex 
)

Return GPtrArray* of field_info pointer for first hfindex that appear in tree. Works with any tree, primed or unprimed, and is slower than proto_get_finfo_ptr_array because it has to search through the tree.

Parameters
treetree of interest
hfindexindex of field info of interest
Returns
GPtrArry pointer

◆ proto_find_undecoded_data()

WS_DLL_PUBLIC gchar* proto_find_undecoded_data ( proto_tree tree,
guint  length 
)

Find undecoded bytes in a tree

Parameters
treetree of interest
lengththe length of the frame
Returns
an array to be used as bitmap of decoded bytes

◆ proto_free_deregistered_fields()

WS_DLL_PUBLIC void proto_free_deregistered_fields ( void  )

Free fields deregistered in proto_deregister_field().

◆ proto_free_field_strings()

WS_DLL_PUBLIC void proto_free_field_strings ( ftenum_t  field_type,
unsigned int  field_display,
const void *  field_strings 
)

Free strings in a field.

Parameters
field_typethe field type (one of FT_ values)
field_displayfield display value (one of BASE_ values)
field_stringsfield strings

◆ proto_get_finfo_ptr_array()

WS_DLL_PUBLIC GPtrArray* proto_get_finfo_ptr_array ( const proto_tree tree,
const int  hfindex 
)

Return GPtrArray* of field_info pointers for all hfindex that appear in tree. Only works with primed trees, and is fast.

Parameters
treetree of interest
hfindexprimed hfindex
Returns
GPtrArray pointer

◆ proto_get_first_protocol()

WS_DLL_PUBLIC int proto_get_first_protocol ( void **  cookie)

Routines to use to iterate over the protocols and their fields; they return the item number of the protocol in question or the appropriate hfinfo pointer, and keep state in "*cookie".

◆ proto_get_frame_protocols()

WS_DLL_PUBLIC void proto_get_frame_protocols ( const wmem_list_t layers,
gboolean *  is_ip,
gboolean *  is_tcp,
gboolean *  is_udp,
gboolean *  is_sctp,
gboolean *  is_tls,
gboolean *  is_rtp,
gboolean *  is_lte_rlc 
)

Find commonly-used protocols in a layer list.

Parameters
layersProtocol layer list
is_ipSet to TRUE if the layer list contains IPv4 or IPv6, otherwise unchanged. May be NULL.
is_tcpSet to TRUE if the layer list contains TCP, otherwise unchanged. May be NULL.
is_udpSet to TRUE if the layer list contains UDP, otherwise unchanged. May be NULL.
is_sctpSet to TRUE if the layer list contains SCTP, otherwise unchanged. May be NULL.
is_tlsSet to TRUE if the layer list contains SSL/TLS, otherwise unchanged. May be NULL.
is_rtpSet to TRUE if the layer list contains RTP, otherwise unchanged. May be NULL.
is_lte_rlcSet to TRUE if the layer list contains LTE RLC, otherwise unchanged. May be NULL.

◆ proto_get_id()

WS_DLL_PUBLIC int proto_get_id ( const protocol_t protocol)

Get the protocol's item number, for the given protocol's "protocol_t".

Returns
its proto_id

◆ proto_get_id_by_filter_name()

WS_DLL_PUBLIC int proto_get_id_by_filter_name ( const gchar *  filter_name)

Given a protocol's filter_name.

Parameters
filter_namethe filter name to search for
Returns
proto_id

◆ proto_get_id_by_short_name()

WS_DLL_PUBLIC int proto_get_id_by_short_name ( const gchar *  short_name)

Given a protocol's short name.

Parameters
short_namethe protocol short name to search for
Returns
proto_id

◆ proto_get_protocol_filter_name()

WS_DLL_PUBLIC const char* proto_get_protocol_filter_name ( const int  proto_id)

Get a protocol's filter name by its item number.

Parameters
proto_idprotocol id (0-indexed)
Returns
its filter name.

◆ proto_get_protocol_long_name()

WS_DLL_PUBLIC const char* proto_get_protocol_long_name ( const protocol_t protocol)

Get the protocol's long name, for the given protocol's "protocol_t".

Returns
its long name.

◆ proto_get_protocol_name()

WS_DLL_PUBLIC const char* proto_get_protocol_name ( const int  proto_id)

Get the protocol's name for the given protocol's item number.

Parameters
proto_idprotocol id (0-indexed)
Returns
its name

◆ proto_get_protocol_short_name()

WS_DLL_PUBLIC const char* proto_get_protocol_short_name ( const protocol_t protocol)

Get the protocol's short name, for the given protocol's "protocol_t".

Returns
its short name.

◆ proto_heuristic_dissector_foreach()

WS_DLL_PUBLIC void proto_heuristic_dissector_foreach ( const protocol_t protocol,
GFunc  func,
gpointer  user_data 
)

Apply func to all heuristic dissectors of a protocol

Parameters
protocolto iterate over heuristics
funcfunction to execute on heuristics
user_datauser-specific data for function

◆ proto_init()

void proto_init ( GSList *  register_all_plugin_protocols_list,
GSList *  register_all_plugin_handoffs_list,
register_cb  cb,
void *  client_data 
)

Sets up memory used by proto routines. Called at program startup

◆ proto_initialize_all_prefixes()

WS_DLL_PUBLIC void proto_initialize_all_prefixes ( void  )

Initialize every remaining uninitialized prefix.

◆ proto_is_frame_protocol()

WS_DLL_PUBLIC gboolean proto_is_frame_protocol ( const wmem_list_t layers,
const char *  proto_name 
)

Check whether a protocol, specified by name, is in a layer list.

Parameters
layersProtocol layer list
proto_nameName of protocol to find
Returns
TRUE if the protocol is found, FALSE if it isn't

◆ proto_is_pino()

WS_DLL_PUBLIC gboolean proto_is_pino ( const protocol_t protocol)

Is this a protocol in name only (i.e. not a real one)?

Returns
TRUE if helper, FALSE if not

◆ proto_is_protocol_enabled()

WS_DLL_PUBLIC gboolean proto_is_protocol_enabled ( const protocol_t protocol)

Is protocol's decoding enabled ?

Returns
TRUE if decoding is enabled, FALSE if not

◆ proto_is_protocol_enabled_by_default()

WS_DLL_PUBLIC gboolean proto_is_protocol_enabled_by_default ( const protocol_t protocol)

Is protocol's enabled by default (most are)?

Returns
TRUE if decoding is enabled by default, FALSE if not

◆ proto_item_add_subtree()

WS_DLL_PUBLIC proto_tree* proto_item_add_subtree ( proto_item pi,
const gint  idx 
)

Create a subtree under an existing item.

Parameters
pithe parent item of the new subtree
idxone of the ett_ array elements registered with proto_register_subtree_array()
Returns
the new subtree

◆ proto_item_append_text()

WS_DLL_PUBLIC void WS_DLL_PUBLIC void proto_item_append_text ( proto_item pi,
const char *  format,
  ... 
)

Append to text of item after it has already been created.

Parameters
pithe item to append the text to
formatprintf like format string
...printf like parameters

◆ proto_item_fill_display_label()

WS_DLL_PUBLIC int proto_item_fill_display_label ( field_info fi,
gchar *  display_label_str,
const int  label_str_size 
)

Fill the given display_label_str with the string representation of a field formatted according to its type and field display specifier. Used to display custom columns and packet diagram values.

Parameters
fiThe item to get the info from
display_label_strThe string to fill
Returns
The length of the label excluding the terminating '\0'.

◆ proto_item_fill_label()

WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC void proto_item_fill_label ( field_info finfo,
gchar *  label_str 
)

Fill given label_str with a simple string representation of field.

Parameters
finfothe item to get the info from
label_strthe string to fill
Todo:
think about changing the parameter profile

◆ proto_item_get_display_repr()

WS_DLL_PUBLIC char* proto_item_get_display_repr ( wmem_allocator_t scope,
proto_item pi 
)

Get the display representation of a proto_item. Can be used, for example, to append that to the parent item of that item.

Parameters
scopethe wmem scope to use to allocate the string
pithe item from which to get the display representation
Returns
the display representation

◆ proto_item_get_len()

WS_DLL_PUBLIC int proto_item_get_len ( const proto_item pi)

Get length of a proto_item. Useful after using proto_tree_add_item() to add a variable-length field (e.g., FT_UINT_STRING).

Parameters
pithe item to get the length from
Returns
the current length

◆ proto_item_get_parent()

WS_DLL_PUBLIC proto_item* proto_item_get_parent ( const proto_item pi)

Get the parent of a subtree item.

Parameters
pithe child item in the subtree
Returns
parent item or NULL

◆ proto_item_get_parent_nth()

WS_DLL_PUBLIC proto_item* proto_item_get_parent_nth ( proto_item pi,
int  gen 
)

Get Nth generation parent item.

Parameters
pithe child item in the subtree
genthe generation to get (using 1 here is the same as using proto_item_get_parent())
Returns
parent item

◆ proto_item_get_subtree()

WS_DLL_PUBLIC proto_tree* proto_item_get_subtree ( proto_item pi)

Get an existing subtree under an item.

Parameters
pithe parent item of the subtree
Returns
the subtree or NULL

◆ proto_item_prepend_text()

WS_DLL_PUBLIC void WS_DLL_PUBLIC void WS_DLL_PUBLIC void proto_item_prepend_text ( proto_item pi,
const char *  format,
  ... 
)

Prepend to text of item after it has already been created.

Parameters
pithe item to prepend the text to
formatprintf like format string
...printf like parameters

◆ proto_item_set_bits_offset_len()

WS_DLL_PUBLIC void proto_item_set_bits_offset_len ( proto_item ti,
int  bits_offset,
int  bits_len 
)

Set the bit offset and length for the specified proto_item.

Parameters
tiThe item to set.
bits_offsetThe number of bits from the beginning of the field.
bits_lenThe new length in bits.

◆ proto_item_set_end()

WS_DLL_PUBLIC void proto_item_set_end ( proto_item pi,
tvbuff_t tvb,
gint  end 
)

Sets the length of the item based on its start and on the specified offset, which is the offset past the end of the item; as the start in the item is relative to the beginning of the data source tvbuff, we need to pass in a tvbuff.

Given an item created as: ti = proto_tree_add_item(*, *, tvb, offset, -1, *); then proto_item_set_end(ti, tvb, end); is equivalent to proto_item_set_len(ti, end - offset);

Parameters
pithe item to set the length
tvbend is relative to this tvbuff
endthis end offset is relative to the beginning of tvb
Todo:
make usage clearer, I don't understand it!

◆ proto_item_set_len()

WS_DLL_PUBLIC void WS_DLL_PUBLIC void WS_DLL_PUBLIC void WS_DLL_PUBLIC void proto_item_set_len ( proto_item pi,
const gint  length 
)

Set proto_item's length inside tvb, after it has already been created.

Parameters
pithe item to set the length
lengththe new length of the item

◆ proto_item_set_text()

WS_DLL_PUBLIC void proto_item_set_text ( proto_item pi,
const char *  format,
  ... 
)

Replace text of item after it already has been created.

Parameters
pithe item to set the text
formatprintf like format string
...printf like parameters

◆ proto_list_layers()

WS_DLL_PUBLIC gchar* proto_list_layers ( const packet_info pinfo)

Create a string of all layers in the packet.

Parameters
pinfoPointer to packet info
Returns
string of layer names

◆ proto_name_already_registered()

WS_DLL_PUBLIC int proto_name_already_registered ( const gchar *  name)

Check if a protocol name is already registered.

Parameters
namethe name to search for
Returns
proto_id

◆ proto_reenable_all()

WS_DLL_PUBLIC void proto_reenable_all ( void  )

Re-enable all protocols that are not marked as disabled by default.

◆ proto_register_alias()

WS_DLL_PUBLIC void proto_register_alias ( const int  proto_id,
const char *  alias_name 
)

Register a protocol alias. This is for dissectors whose original name has changed, e.g. BOOTP to DHCP.

Parameters
proto_idprotocol id returned by proto_register_protocol (0-indexed)
alias_namealias for the protocol's filter name

◆ proto_register_field_array()

WS_DLL_PUBLIC void proto_register_field_array ( const int  parent,
hf_register_info hf,
const int  num_records 
)

Register a header_field array.

Parameters
parentthe protocol handle from proto_register_protocol()
hfthe hf_register_info array
num_recordsthe number of records in hf

◆ proto_register_plugin()

WS_DLL_PUBLIC void proto_register_plugin ( const proto_plugin plugin)

Register dissector plugin with the plugin system.

◆ proto_register_prefix()

WS_DLL_PUBLIC void proto_register_prefix ( const char *  prefix,
prefix_initializer_t  initializer 
)

Register a new prefix for delayed initialization of field arrays Note that the initializer function MAY NOT be called before the dissector is first called. That is, dissectors using this function must be prepared to call the initializer before beginning dissection; they should do this by calling proto_registrar_get_byname() on one of the dissector's field names.

Parameters
prefixthe prefix for the new protocol
initializerfunction that will initialize the field array for the given prefix

◆ proto_register_protocol()

WS_DLL_PUBLIC int proto_register_protocol ( const char *  name,
const char *  short_name,
const char *  filter_name 
)

Register a new protocol.

Parameters
namethe full name of the new protocol
short_nameabbreviated name of the new protocol
filter_nameprotocol name used for a display filter string
Returns
the new protocol handle

◆ proto_register_protocol_in_name_only()

WS_DLL_PUBLIC int proto_register_protocol_in_name_only ( const char *  name,
const char *  short_name,
const char *  filter_name,
int  parent_proto,
enum ftenum  field_type 
)

Register a "helper" protocol (pino - protocol in name only). This is for dissectors that need distinguishing names and don't need the other features (like enable/disable). One use case is a protocol with multiple dissection functions in a single dissector table needing unique "dissector names" to remove confusion with Decode As dialog. Another use case is for a dissector table set up to handle TLVs within a single protocol (and allow "external" TLVs being registered through the dissector table).

Parameters
namethe full name of the new protocol
short_nameabbreviated name of the new protocol
filter_nameprotocol name used for a display filter string
parent_protothe "real" protocol for the helper. The parent decides enable/disable
field_typeFT_PROTOCOL or FT_BYTES. Allows removal of "protocol highlighting" (FT_BYTES) if pino is part of TLV.
Returns
the new protocol handle

◆ proto_register_subtree_array()

WS_DLL_PUBLIC void proto_register_subtree_array ( gint *const *  indices,
const int  num_indices 
)

Register a protocol subtree (ett) array.

Parameters
indicesarray of ett indices
num_indicesthe number of records in indices

◆ proto_registrar_dump_elastic()

WS_DLL_PUBLIC void proto_registrar_dump_elastic ( const gchar *  filter)

Dumps a mapping file for loading tshark output into ElasticSearch

◆ proto_registrar_dump_field_completions()

WS_DLL_PUBLIC gboolean proto_registrar_dump_field_completions ( char *  prefix)

Dumps protocol and field abbreviations to STDOUT which start with prefix.

◆ proto_registrar_dump_fieldcount()

WS_DLL_PUBLIC gboolean proto_registrar_dump_fieldcount ( void  )

Dumps the number of protocol and field registrations to STDOUT.

Returns
FALSE if we pre-allocated enough fields, TRUE otherwise.

◆ proto_registrar_dump_fields()

WS_DLL_PUBLIC void proto_registrar_dump_fields ( void  )

Dumps a glossary of the protocol and field registrations to STDOUT.

◆ proto_registrar_dump_ftypes()

WS_DLL_PUBLIC void proto_registrar_dump_ftypes ( void  )

Dumps a glossary field types and descriptive names to STDOUT

◆ proto_registrar_dump_protocols()

WS_DLL_PUBLIC void proto_registrar_dump_protocols ( void  )

Dumps a glossary of the protocol registrations to STDOUT

◆ proto_registrar_dump_values()

WS_DLL_PUBLIC void proto_registrar_dump_values ( void  )

Dumps a glossary of the field value strings or true/false strings to STDOUT

◆ proto_registrar_get_abbrev()

WS_DLL_PUBLIC const char* proto_registrar_get_abbrev ( const int  n)

Get abbreviation of registered header_field number n.

Parameters
nitem # n (0-indexed)
Returns
the abbreviation of this registered item

◆ proto_registrar_get_byalias()

WS_DLL_PUBLIC header_field_info* proto_registrar_get_byalias ( const char *  alias_name)

Get the header_field information based upon a field alias.

Parameters
alias_namethe aliased field name to search for
Returns
the registered item

◆ proto_registrar_get_byname()

WS_DLL_PUBLIC header_field_info* proto_registrar_get_byname ( const char *  field_name)

Get the header_field information based upon a field name.

Parameters
field_namethe field name to search for
Returns
the registered item

◆ proto_registrar_get_ftype()

WS_DLL_PUBLIC enum ftenum proto_registrar_get_ftype ( const int  n)

Get enum ftenum FT_ of registered header_field number n.

Parameters
nitem # n (0-indexed)
Returns
the registered item

◆ proto_registrar_get_id_byname()

WS_DLL_PUBLIC int proto_registrar_get_id_byname ( const char *  field_name)

Get the header_field id based upon a field name.

Parameters
field_namethe field name to search for
Returns
the field id for the registered item

◆ proto_registrar_get_length()

gint proto_registrar_get_length ( const int  n)

Get length of registered field according to field type.

Parameters
nitem # n (0-indexed)
Returns
0 means undeterminable at registration time, -1 means unknown field

◆ proto_registrar_get_name()

WS_DLL_PUBLIC const char* proto_registrar_get_name ( const int  n)

Get name of registered header_field number n.

Parameters
nitem # n (0-indexed)
Returns
the name of this registered item

◆ proto_registrar_get_nth()

WS_DLL_PUBLIC header_field_info* proto_registrar_get_nth ( guint  hfindex)

Get the header_field information based upon a field or protocol id.

Parameters
hfindexitem # n (0-indexed)
Returns
the registered item

◆ proto_registrar_get_parent()

WS_DLL_PUBLIC int proto_registrar_get_parent ( const int  n)

Get parent protocol of registered header_field number n.

Parameters
nitem # n (0-indexed)
Returns
-1 if item is a protocol

◆ proto_registrar_is_protocol()

WS_DLL_PUBLIC gboolean proto_registrar_is_protocol ( const int  n)

Is item # n a protocol?

Parameters
nitem # n (0-indexed)
Returns
TRUE if it's a protocol, FALSE if it's not

◆ proto_report_dissector_bug()

WS_DLL_PUBLIC WS_NORETURN void proto_report_dissector_bug ( const char *  format,
  ... 
)

Function used for reporting errors in dissectors; it throws a DissectorError exception, with a string generated from the format and arguments to the format, as the message for the exception, so that it can show up in the Info column and the protocol tree.

If the WIRESHARK_ABORT_ON_DISSECTOR_BUG environment variable is set, it will call abort(), instead, to make it easier to get a stack trace.

Parameters
formatformat string to use for the message

◆ proto_set_cant_toggle()

WS_DLL_PUBLIC void proto_set_cant_toggle ( const int  proto_id)

Disable disabling/enabling of protocol of the given item number.

Parameters
proto_idprotocol id (0-indexed)

◆ proto_set_decoding()

WS_DLL_PUBLIC void proto_set_decoding ( const int  proto_id,
const gboolean  enabled 
)

Enable / Disable protocol of the given item number.

Parameters
proto_idprotocol id (0-indexed)
enabledenable / disable the protocol

◆ proto_tracking_interesting_fields()

WS_DLL_PUBLIC gboolean proto_tracking_interesting_fields ( const proto_tree tree)

Return whether we're tracking any interesting fields. Only works with primed trees, and is fast.

Parameters
treetree of interest
Returns
TRUE if we're tracking interesting fields

◆ proto_tree_add_ascii_7bits_item()

WS_DLL_PUBLIC proto_item* proto_tree_add_ascii_7bits_item ( proto_tree tree,
const int  hfindex,
tvbuff_t tvb,
const guint  bit_offset,
const gint  no_of_chars 
)

Add a FT_STRING with ENC_ASCII_7BITS encoding to a proto_tree.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
bit_offsetstart of data in tvb expressed in bits
no_of_charsnumber of 7bits characters to display
Returns
the newly created item

◆ proto_tree_add_bitmask()

WS_DLL_PUBLIC proto_item* proto_tree_add_bitmask ( proto_tree tree,
tvbuff_t tvb,
const guint  offset,
const int  hf_hdr,
const gint  ett,
int *const *  fields,
const guint  encoding 
)

This function will dissect a sequence of bytes that describe a bitmask.

Parameters
treethe tree to append this item to
tvbthe tv buffer of the current data
offsetstart of data in tvb
hf_hdran 8/16/24/32/40/48/56/64 bit integer that describes the bitmask to be dissected. This field will form an expansion under which the individual fields of the bitmask are dissected and displayed. This field must be of the type FT_[U]INT{8|16|24|32|40|48|56|64}.
ettsubtree index
fieldsan array of pointers to int that lists all the fields of the bitmask. These fields can be either of the type FT_BOOLEAN for flags or another integer of the same type/size as hf_hdr with a mask specified. This array is terminated by a NULL entry. FT_BOOLEAN bits that are set to 1 will have the name added to the expansion. FT_integer fields that have a value_string attached will have the matched string displayed on the expansion line.
encodingbig or little endian byte representation (ENC_BIG_ENDIAN/ENC_LITTLE_ENDIAN/ENC_HOST_ENDIAN)
Returns
the newly created item

◆ proto_tree_add_bitmask_len()

WS_DLL_PUBLIC proto_item* proto_tree_add_bitmask_len ( proto_tree tree,
tvbuff_t tvb,
const guint  offset,
const guint  len,
const int  hf_hdr,
const gint  ett,
int *const *  fields,
struct expert_field exp,
const guint  encoding 
)

This function will dissect a sequence of bytes that describe a bitmask.

Parameters
treethe tree to append this item to
tvbthe tv buffer of the current data
offsetstart of data in tvb
lennumber of bytes of data
hf_hdran 8/16/24/32 bit integer that describes the bitmask to be dissected. This field will form an expansion under which the individual fields of the bitmask are dissected and displayed. This field must be of the type FT_[U]INT{8|16|24|32}.
ettsubtree index
fieldsan array of pointers to int that lists all the fields of the bitmask. These fields can be either of the type FT_BOOLEAN for flags or another integer with a mask specified. This array is terminated by a NULL entry. FT_BOOLEAN bits that are set to 1 will have the name added to the expansion. FT_integer fields that have a value_string attached will have the matched string displayed on the expansion line.
expexpert info field used when decodable_len < len. This also means this function should be called even when tree == NULL
encodingbig or little endian byte representation (ENC_BIG_ENDIAN/ENC_LITTLE_ENDIAN/ENC_HOST_ENDIAN)
Returns
the newly created item

◆ proto_tree_add_bitmask_list()

WS_DLL_PUBLIC void proto_tree_add_bitmask_list ( proto_tree tree,
tvbuff_t tvb,
const guint  offset,
const int  len,
int *const *  fields,
const guint  encoding 
)

This function will dissect a sequence of bytes that describe a bitmask. Similar to proto_tree_add_bitmask(), but with no "header" item to group all of the fields

Parameters
treethe tree to append this item to
tvbthe tv buffer of the current data
offsetstart of data in tvb
lennumber of bytes of data
fieldsan array of pointers to int that lists all the fields of the bitmask. These fields can be either of the type FT_BOOLEAN for flags or another integer of the same type/size as hf_hdr with a mask specified. This array is terminated by a NULL entry. FT_BOOLEAN bits that are set to 1 will have the name added to the expansion. FT_integer fields that have a value_string attached will have the matched string displayed on the expansion line.
encodingbig or little endian byte representation (ENC_BIG_ENDIAN/ENC_LITTLE_ENDIAN/ENC_HOST_ENDIAN)

◆ proto_tree_add_bitmask_list_ret_uint64()

WS_DLL_PUBLIC void proto_tree_add_bitmask_list_ret_uint64 ( proto_tree tree,
tvbuff_t tvb,
const guint  offset,
const int  len,
int *const *  fields,
const guint  encoding,
guint64 *  retval 
)

This function will dissect a value that describe a bitmask. Similar to proto_tree_add_bitmask_list(), but with a return value

Parameters
treethe tree to append this item to
tvbthe tv buffer of the current data
offsetstart of data in tvb
lennumber of bytes of data
fieldsan array of pointers to int that lists all the fields of the bitmask. These fields can be either of the type FT_BOOLEAN for flags or another integer of the same type/size as hf_hdr with a mask specified. This array is terminated by a NULL entry. FT_BOOLEAN bits that are set to 1 will have the name added to the expansion. FT_integer fields that have a value_string attached will have the matched string displayed on the expansion line.
encodingbig or little endian byte representation (ENC_BIG_ENDIAN/ENC_LITTLE_ENDIAN/ENC_HOST_ENDIAN)
retvalif a pointer is passed here the value is returned.

◆ proto_tree_add_bitmask_list_value()

WS_DLL_PUBLIC void proto_tree_add_bitmask_list_value ( proto_tree tree,
tvbuff_t tvb,
const guint  offset,
const int  len,
int *const *  fields,
const guint64  value 
)

This function will dissect a value that describe a bitmask. Similar to proto_tree_add_bitmask_list(), but with a passed in value (presumably because it can't be retrieved directly from tvb)

Parameters
treethe tree to append this item to
tvbthe tv buffer of the current data
offsetstart of data in tvb
lennumber of bytes of data
fieldsan array of pointers to int that lists all the fields of the bitmask. These fields can be either of the type FT_BOOLEAN for flags or another integer of the same type/size as hf_hdr with a mask specified. This array is terminated by a NULL entry. FT_BOOLEAN bits that are set to 1 will have the name added to the expansion. FT_integer fields that have a value_string attached will have the matched string displayed on the expansion line.
valuebitmask value

◆ proto_tree_add_bitmask_ret_uint64()

WS_DLL_PUBLIC proto_item* proto_tree_add_bitmask_ret_uint64 ( proto_tree tree,
tvbuff_t tvb,
const guint  offset,
const int  hf_hdr,
const gint  ett,
int *const *  fields,
const guint  encoding,
guint64 *  retval 
)

This function will dissect a sequence of bytes that describe a bitmask. The value of the integer containing the bitmask is returned through a pointer.

Parameters
treethe tree to append this item to
tvbthe tv buffer of the current data
offsetstart of data in tvb
hf_hdran 8/16/24/32/40/48/56/64 bit integer that describes the bitmask to be dissected. This field will form an expansion under which the individual fields of the bitmask are dissected and displayed. This field must be of the type FT_[U]INT{8|16|24|32|40|48|56|64}.
ettsubtree index
fieldsan array of pointers to int that lists all the fields of the bitmask. These fields can be either of the type FT_BOOLEAN for flags or another integer of the same type/size as hf_hdr with a mask specified. This array is terminated by a NULL entry. FT_BOOLEAN bits that are set to 1 will have the name added to the expansion. FT_integer fields that have a value_string attached will have the matched string displayed on the expansion line.
encodingbig or little endian byte representation (ENC_BIG_ENDIAN/ENC_LITTLE_ENDIAN/ENC_HOST_ENDIAN)
[out]retvalpoints to a guint64 which will be set
Returns
the newly created item, and *retval is set to the decoded value masked/shifted according to bitmask

◆ proto_tree_add_bitmask_text()

WS_DLL_PUBLIC proto_item* proto_tree_add_bitmask_text ( proto_tree tree,
tvbuff_t tvb,
const guint  offset,
const guint  len,
const char *  name,
const char *  fallback,
const gint  ett,
int *const *  fields,
const guint  encoding,
const int  flags 
)

Add a text with a subtree of bitfields.

Parameters
treethe tree to append this item to
tvbthe tv buffer of the current data
offsetstart of data in tvb
lenlength of the field name
namefield name (NULL if bitfield contents should be used)
fallbackfield name if none of bitfields were usable
ettsubtree index
fieldsNULL-terminated array of bitfield indexes
encodingbig or little endian byte representation (ENC_BIG_ENDIAN/ENC_LITTLE_ENDIAN/ENC_HOST_ENDIAN)
flagsbitmask field
Returns
the newly created item

◆ proto_tree_add_bitmask_value()

WS_DLL_PUBLIC proto_item* proto_tree_add_bitmask_value ( proto_tree tree,
tvbuff_t tvb,
const guint  offset,
const int  hf_hdr,
const gint  ett,
int *const *  fields,
const guint64  value 
)

This function will dissect a value that describe a bitmask. Similar to proto_tree_add_bitmask(), but with a passed in value (presumably because it can't be retrieved directly from tvb)

Parameters
treethe tree to append this item to
tvbthe tv buffer of the current data
offsetstart of data in tvb
hf_hdran 8/16/24/32/64 bit integer that describes the bitmask to be dissected. This field will form an expansion under which the individual fields of the bitmask is dissected and displayed. This field must be of the type FT_[U]INT{8|16|24|32|64}.
ettsubtree index
fieldsan array of pointers to int that lists all the fields of the bitmask. These fields can be either of the type FT_BOOLEAN for flags or another integer of the same type/size as hf_hdr with a mask specified. This array is terminated by a NULL entry. FT_BOOLEAN bits that are set to 1 will have the name added to the expansion. FT_integer fields that have a value_string attached will have the matched string displayed on the expansion line.
valuebitmask value
Returns
the newly created item

◆ proto_tree_add_bitmask_value_with_flags()

WS_DLL_PUBLIC proto_item* proto_tree_add_bitmask_value_with_flags ( proto_tree tree,
tvbuff_t tvb,
const guint  offset,
const int  hf_hdr,
const gint  ett,
int *const *  fields,
const guint64  value,
const int  flags 
)

This function will dissect a value that describe a bitmask. Similar to proto_tree_add_bitmask(), but with a passed in value (presumably because it can't be retrieved directly from tvb) This has "filterable" bitmask header functionality of proto_tree_add_bitmask_value with the ability to control what data is appended to the header like proto_tree_add_bitmask_text

Parameters
treethe tree to append this item to
tvbthe tv buffer of the current data
offsetstart of data in tvb
hf_hdran 8/16/24/32/64 bit integer that describes the bitmask to be dissected. This field will form an expansion under which the individual fields of the bitmask is dissected and displayed. This field must be of the type FT_[U]INT{8|16|24|32|64}.
ettsubtree index
fieldsan array of pointers to int that lists all the fields of the bitmask. These fields can be either of the type FT_BOOLEAN for flags or another integer of the same type/size as hf_hdr with a mask specified. This array is terminated by a NULL entry. FT_BOOLEAN bits that are set to 1 will have the name added to the expansion. FT_integer fields that have a value_string attached will have the matched string displayed on the expansion line.
valuebitmask value
flagsbitmask field using BMT_NO_* flags to determine behavior
Returns
the newly created item

◆ proto_tree_add_bitmask_with_flags()

WS_DLL_PUBLIC proto_item* proto_tree_add_bitmask_with_flags ( proto_tree tree,
tvbuff_t tvb,
const guint  offset,
const int  hf_hdr,
const gint  ett,
int *const *  fields,
const guint  encoding,
const int  flags 
)

This function will dissect a sequence of bytes that describe a bitmask. This has "filterable" bitmask header functionality of proto_tree_add_bitmask with the ability to control what data is appended to the header like proto_tree_add_bitmask_text

Parameters
treethe tree to append this item to
tvbthe tv buffer of the current data
offsetstart of data in tvb
hf_hdran 8/16/24/32/40/48/56/64 bit integer that describes the bitmask to be dissected. This field will form an expansion under which the individual fields of the bitmask are dissected and displayed. This field must be of the type FT_[U]INT{8|16|24|32|40|48|56|64}.
ettsubtree index
fieldsan array of pointers to int that lists all the fields of the bitmask. These fields can be either of the type FT_BOOLEAN for flags or another integer of the same type/size as hf_hdr with a mask specified. This array is terminated by a NULL entry. FT_BOOLEAN bits that are set to 1 will have the name added to the expansion. FT_integer fields that have a value_string attached will have the matched string displayed on the expansion line.
encodingbig or little endian byte representation (ENC_BIG_ENDIAN/ENC_LITTLE_ENDIAN/ENC_HOST_ENDIAN)
flagsbitmask field using BMT_NO_* flags to determine behavior
Returns
the newly created item

◆ proto_tree_add_bitmask_with_flags_ret_uint64()

WS_DLL_PUBLIC proto_item* proto_tree_add_bitmask_with_flags_ret_uint64 ( proto_tree tree,
tvbuff_t tvb,
const guint  offset,
const int  hf_hdr,
const gint  ett,
int *const *  fields,
const guint  encoding,
const int  flags,
guint64 *  retval 
)

This function will dissect a sequence of bytes that describe a bitmask. This has "filterable" bitmask header functionality of proto_tree_add_bitmask with the ability to control what data is appended to the header like proto_tree_add_bitmask_text The value of the integer containing the bitmask is returned through a pointer.

Parameters
treethe tree to append this item to
tvbthe tv buffer of the current data
offsetstart of data in tvb
hf_hdran 8/16/24/32/40/48/56/64 bit integer that describes the bitmask to be dissected. This field will form an expansion under which the individual fields of the bitmask are dissected and displayed. This field must be of the type FT_[U]INT{8|16|24|32|40|48|56|64}.
ettsubtree index
fieldsan array of pointers to int that lists all the fields of the bitmask. These fields can be either of the type FT_BOOLEAN for flags or another integer of the same type/size as hf_hdr with a mask specified. This array is terminated by a NULL entry. FT_BOOLEAN bits that are set to 1 will have the name added to the expansion. FT_integer fields that have a value_string attached will have the matched string displayed on the expansion line.
encodingbig or little endian byte representation (ENC_BIG_ENDIAN/ENC_LITTLE_ENDIAN/ENC_HOST_ENDIAN)
flagsbitmask field using BMT_NO_* flags to determine behavior
[out]retvalpoints to a guint64 which will be set
Returns
the newly created item, and *retval is set to the decoded value masked/shifted according to bitmask

◆ proto_tree_add_bits_item()

WS_DLL_PUBLIC proto_item* proto_tree_add_bits_item ( proto_tree tree,
const int  hf_index,
tvbuff_t tvb,
const guint  bit_offset,
const gint  no_of_bits,
const guint  encoding 
)

Add bits to a proto_tree, using the text label registered to that item. The item is extracted from the tvbuff handed to it.

Parameters
treethe tree to append this item to
hf_indexfield index. Fields for use with this function should have bitmask==0.
tvbthe tv buffer of the current data
bit_offsetstart of data in tvb expressed in bits
no_of_bitslength of data in tvb expressed in bits
encodingdata encoding
Returns
the newly created item

◆ proto_tree_add_bits_ret_val()

WS_DLL_PUBLIC proto_item* proto_tree_add_bits_ret_val ( proto_tree tree,
const int  hf_index,
tvbuff_t tvb,
const guint  bit_offset,
const gint  no_of_bits,
guint64 *  return_value,
const guint  encoding 
)

Add bits to a proto_tree, using the text label registered to that item. The item is extracted from the tvbuff handed to it.

Parameters
treethe tree to append this item to
hf_indexfield index. Fields for use with this function should have bitmask==0.
tvbthe tv buffer of the current data
bit_offsetstart of data in tvb expressed in bits
no_of_bitslength of data in tvb expressed in bits
return_valueif a pointer is passed here the value is returned.
encodingdata encoding
Returns
the newly created item

◆ proto_tree_add_boolean()

WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item* proto_tree_add_boolean ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
guint64  value 
)

Add a FT_BOOLEAN to a proto_tree.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
valuedata to display
Returns
the newly created item

◆ proto_tree_add_boolean_bits_format_value()

WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item proto_item* proto_tree_add_boolean_bits_format_value ( proto_tree tree,
const int  hf_index,
tvbuff_t tvb,
const guint  bit_offset,
const gint  no_of_bits,
guint64  value,
const guint  encoding,
const char *  format,
  ... 
)

Add bits for a FT_BOOLEAN header field to a proto_tree, with the format generating the string for the value and with the field name being included automatically.

Parameters
treethe tree to append this item to
hf_indexfield index
tvbthe tv buffer of the current data
bit_offsetstart of data in tvb expressed in bits
no_of_bitslength of data in tvb expressed in bit
valuedata to display
encodingdata encoding
formatprintf like format string
...printf like parameters
Returns
the newly created item

◆ proto_tree_add_boolean_format()

WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item* proto_tree_add_boolean_format ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
guint64  value,
const char *  format,
  ... 
)

Add a formatted FT_BOOLEAN to a proto_tree, with the format generating the entire string for the entry, including any field name.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
valuedata to display
formatprintf like format string
...printf like parameters
Returns
the newly created item

◆ proto_tree_add_boolean_format_value()

WS_DLL_PUBLIC proto_item* proto_tree_add_boolean_format_value ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
guint64  value,
const char *  format,
  ... 
)

Add a formatted FT_BOOLEAN to a proto_tree, with the format generating the string for the value and with the field name being included automatically.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
valuedata to display
formatprintf like format string
...printf like parameters
Returns
the newly created item

◆ proto_tree_add_bytes()

WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item* proto_tree_add_bytes ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
const guint8 *  start_ptr 
)

Add a FT_BYTES to a proto_tree.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
start_ptrpointer to the data to display
Returns
the newly created item

◆ proto_tree_add_bytes_format()

WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item* proto_tree_add_bytes_format ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
const guint8 *  start_ptr,
const char *  format,
  ... 
)

Add a formatted FT_BYTES to a proto_tree, with the format generating the entire string for the entry, including any field name.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
start_ptrpointer to the data to display
formatprintf like format string
...printf like parameters
Returns
the newly created item

◆ proto_tree_add_bytes_format_value()

WS_DLL_PUBLIC proto_item* proto_tree_add_bytes_format_value ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
const guint8 *  start_ptr,
const char *  format,
  ... 
)

Add a formatted FT_BYTES to a proto_tree, with the format generating the string for the value and with the field name being included automatically.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
start_ptrpointer to the data to display
formatprintf like format string
...printf like parameters
Returns
the newly created item

◆ proto_tree_add_bytes_item()

WS_DLL_PUBLIC proto_item* proto_tree_add_bytes_item ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
const gint  start,
gint  length,
const guint  encoding,
GByteArray *  retval,
gint *  endoff,
gint *  err 
)

Get and add a byte-array-based FT_* to a proto_tree.

Supported: FT_BYTES, FT_UINT_BYTES, FT_OID, FT_REL_OID, and FT_SYSTEM_ID.

The item is extracted from the tvbuff handed to it, based on the ENC_* passed in for the encoding, and the retrieved byte array is also set to *retval so the caller gets it back for other uses.

This function retrieves the value even if the passed-in tree param is NULL, so that it can be used by dissectors at all times to both get the value and set the tree item to it.

Like other proto_tree_add functions, if there is a tree and the value cannot be decoded from the tvbuff, then an expert info error is reported. For string encoding, this means that a failure to decode the hex value from the string results in an expert info error being added to the tree.

If encoding is string-based, it will convert using tvb_get_string_bytes(); see that function's comments for details.

Note
The GByteArray retval must be pre-constructed using g_byte_array_new().
Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
encodingdata encoding (e.g, ENC_LITTLE_ENDIAN, or ENC_UTF_8|ENC_STR_HEX)
[in,out]retvalpoints to a GByteArray which will be set to the bytes from the Tvb.
[in,out]endoffif not NULL, gets set to the character after those consumed.
[in,out]errif not NULL, gets set to 0 if no failure, else the errno code (e.g., EINVAL).
Returns
the newly created item, and retval is set to the decoded value

◆ proto_tree_add_bytes_with_length()

WS_DLL_PUBLIC proto_item* proto_tree_add_bytes_with_length ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
const guint8 *  start_ptr,
gint  ptr_length 
)

Add a FT_BYTES to a proto_tree like proto_tree_add_bytes, but used when the tvb data length does not match the bytes length.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
start_ptrpointer to the data to display
ptr_lengthlength of data in start_ptr
Returns
the newly created item

◆ proto_tree_add_checksum()

WS_DLL_PUBLIC proto_item* proto_tree_add_checksum ( proto_tree tree,
tvbuff_t tvb,
const guint  offset,
const int  hf_checksum,
const int  hf_checksum_status,
struct expert_field bad_checksum_expert,
packet_info pinfo,
guint32  computed_checksum,
const guint  encoding,
const guint  flags 
)

Add a checksum field to a proto_tree. This standardizes the display of a checksum field as well as any status and expert info supporting it.

Parameters
treethe tree to append this item to
tvbthe tv buffer of the current data
offsetstart of data in tvb
hf_checksumchecksum field index
hf_checksum_statusoptional checksum status field index. If none exists, just pass -1
bad_checksum_expertoptional expert info for a bad checksum. If none exists, just pass NULL
pinfoPacket info used for optional expert info. If unused, NULL can be passed
computed_checksumChecksum to verify against
encodingdata encoding of checksum from tvb
flagsbitmask field of PROTO_CHECKSUM_ options
Returns
the newly created item

◆ proto_tree_add_checksum_bytes()

WS_DLL_PUBLIC proto_item* proto_tree_add_checksum_bytes ( proto_tree tree,
tvbuff_t tvb,
const guint  offset,
const int  hf_checksum,
const int  hf_checksum_status,
struct expert_field bad_checksum_expert,
packet_info pinfo,
const uint8_t *  computed_checksum,
size_t  checksum_len,
const guint  flags 
)

Add a checksum bytes array field to a proto_tree. This standardizes the display of a checksum field as well as any status and expert info supporting it.

Parameters
treethe tree to append this item to
tvbthe tv buffer of the current data
offsetstart of data in tvb
hf_checksumchecksum field index
hf_checksum_statusoptional checksum status field index. If none exists, just pass -1
bad_checksum_expertoptional expert info for a bad checksum. If none exists, just pass NULL
pinfoPacket info used for optional expert info. If unused, NULL can be passed
computed_checksumChecksum as bytes array to verify against
checksum_lenChecksum size in bytes
flagsbitmask field of PROTO_CHECKSUM_ options. PROTO_CHECKSUM_IN_CKSUM is ignored
Returns
the newly created item

◆ proto_tree_add_debug_text()

WS_DLL_PUBLIC proto_item* proto_tree_add_debug_text ( proto_tree tree,
const char *  format,
  ... 
)

Useful for quick debugging. Also sends string to STDOUT, so don't leave call to this function in production code.

Parameters
treethe tree to append the text to
formatprintf like format string
...printf like parameters
Returns
the newly created item

◆ proto_tree_add_double()

WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item* proto_tree_add_double ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
double  value 
)

Add a FT_DOUBLE to a proto_tree.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
valuedata to display
Returns
the newly created item

◆ proto_tree_add_double_format()

WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item* proto_tree_add_double_format ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
double  value,
const char *  format,
  ... 
)

Add a formatted FT_DOUBLE to a proto_tree, with the format generating the entire string for the entry, including any field name.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
valuedata to display
formatprintf like format string
...printf like parameters
Returns
the newly created item

◆ proto_tree_add_double_format_value()

WS_DLL_PUBLIC proto_item* proto_tree_add_double_format_value ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
double  value,
const char *  format,
  ... 
)

Add a formatted FT_DOUBLE to a proto_tree, with the format generating the string for the value and with the field name being included automatically.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
valuedata to display
formatprintf like format string
...printf like parameters
Returns
the newly created item

◆ proto_tree_add_ether()

WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item* proto_tree_add_ether ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
const guint8 *  value 
)

Add a FT_ETHER to a proto_tree.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
valuedata to display
Returns
the newly created item

◆ proto_tree_add_ether_format()

WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item* proto_tree_add_ether_format ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
const guint8 *  value,
const char *  format,
  ... 
)

Add a formatted FT_ETHER to a proto_tree, with the format generating the entire string for the entry, including any field name.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
valuedata to display
formatprintf like format string
...printf like parameters
Returns
the newly created item

◆ proto_tree_add_ether_format_value()

WS_DLL_PUBLIC proto_item* proto_tree_add_ether_format_value ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
const guint8 *  value,
const char *  format,
  ... 
)

Add a formatted FT_ETHER to a proto_tree, with the format generating the string for the value and with the field name being included automatically.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
valuedata to display
formatprintf like format string
...printf like parameters
Returns
the newly created item

◆ proto_tree_add_eui64()

WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item* proto_tree_add_eui64 ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
const guint64  value 
)

Add a FT_EUI64 to a proto_tree.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
valuedata to display
Returns
the newly created item

◆ proto_tree_add_eui64_format()

WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item* proto_tree_add_eui64_format ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
const guint64  value,
const char *  format,
  ... 
)

Add a formatted FT_EUI64 to a proto_tree, with the format generating the entire string for the entry, including any field name.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
valuedata to display
formatprintf like format string
...printf like parameters
Returns
the newly created item

◆ proto_tree_add_eui64_format_value()

WS_DLL_PUBLIC proto_item* proto_tree_add_eui64_format_value ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
const guint64  value,
const char *  format,
  ... 
)

Add a formatted FT_EUI64 to a proto_tree, with the format generating the string for the value and with the field name being included automatically.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
valuedata to display
formatprintf like format string
...printf like parameters
Returns
the newly created item

◆ proto_tree_add_float()

WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item* proto_tree_add_float ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
float  value 
)

Add a FT_FLOAT to a proto_tree.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
valuedata to display
Returns
the newly created item

◆ proto_tree_add_float_bits_format_value()

WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item proto_item proto_item proto_item proto_item* proto_tree_add_float_bits_format_value ( proto_tree tree,
const int  hf_index,
tvbuff_t tvb,
const guint  bit_offset,
const gint  no_of_bits,
float  value,
const guint  encoding,
const char *  format,
  ... 
)

Add bits for a FT_FLOAT header field to a proto_tree, with the format generating the string for the value and with the field name being included automatically.

Parameters
treethe tree to append this item to
hf_indexfield index
tvbthe tv buffer of the current data
bit_offsetstart of data in tvb expressed in bits
no_of_bitslength of data in tvb expressed in bit
valuedata to display
encodingdata encoding
formatprintf like format string
...printf like parameters
Returns
the newly created item

◆ proto_tree_add_float_format()

WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item* proto_tree_add_float_format ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
float  value,
const char *  format,
  ... 
)

Add a formatted FT_FLOAT to a proto_tree, with the format generating the entire string for the entry, including any field name.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
valuedata to display
formatprintf like format string
...printf like parameters
Returns
the newly created item

◆ proto_tree_add_float_format_value()

WS_DLL_PUBLIC proto_item* proto_tree_add_float_format_value ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
float  value,
const char *  format,
  ... 
)

Add a formatted FT_FLOAT to a proto_tree, with the format generating the string for the value and with the field name being included automatically.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
valuedata to display
formatprintf like format string
...printf like parameters
Returns
the newly created item

◆ proto_tree_add_format_text()

WS_DLL_PUBLIC proto_tree proto_item* proto_tree_add_format_text ( proto_tree tree,
tvbuff_t tvb,
gint  start,
gint  length 
)

Add a text-only node to a proto_tree with tvb_format_text() string.

◆ proto_tree_add_format_wsp_text()

proto_item* proto_tree_add_format_wsp_text ( proto_tree tree,
tvbuff_t tvb,
gint  start,
gint  length 
)

Add a text-only node to a proto_tree with tvb_format_text_wsp() string.

◆ proto_tree_add_guid()

WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item* proto_tree_add_guid ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
const e_guid_t value_ptr 
)

Add a FT_GUID to a proto_tree.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
value_ptrdata to display
Returns
the newly created item

◆ proto_tree_add_guid_format()

WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item* proto_tree_add_guid_format ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
const e_guid_t value_ptr,
const char *  format,
  ... 
)

Add a formatted FT_GUID to a proto_tree, with the format generating the entire string for the entry, including any field name.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
value_ptrdata to display
formatprintf like format string
...printf like parameters
Returns
the newly created item

◆ proto_tree_add_guid_format_value()

WS_DLL_PUBLIC proto_item* proto_tree_add_guid_format_value ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
const e_guid_t value_ptr,
const char *  format,
  ... 
)

Add a formatted FT_GUID to a proto_tree, with the format generating the string for the value and with the field name being included automatically.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
value_ptrdata to display
formatprintf like format string
...printf like parameters
Returns
the newly created item

◆ proto_tree_add_int()

WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item* proto_tree_add_int ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
gint32  value 
)

Add one of FT_INT8, FT_INT16, FT_INT24 or FT_INT32 to a proto_tree.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
valuedata to display
Returns
the newly created item

◆ proto_tree_add_int64()

WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item* proto_tree_add_int64 ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
gint64  value 
)

Add an FT_INT64 to a proto_tree.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
valuedata to display
Returns
the newly created item

◆ proto_tree_add_int64_bits_format_value()

WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item proto_item proto_item proto_item* proto_tree_add_int64_bits_format_value ( proto_tree tree,
const int  hf_index,
tvbuff_t tvb,
const guint  bit_offset,
const gint  no_of_bits,
gint64  value,
const guint  encoding,
const char *  format,
  ... 
)

Add bits for a FT_INT8, FT_INT16, FT_INT24 or FT_INT32 header field to a proto_tree, with the format generating the string for the value and with the field name being included automatically.

Parameters
treethe tree to append this item to
hf_indexfield index
tvbthe tv buffer of the current data
bit_offsetstart of data in tvb expressed in bits
no_of_bitslength of data in tvb expressed in bit
valuedata to display
encodingdata encoding
formatprintf like format string
...printf like parameters
Returns
the newly created item

◆ proto_tree_add_int64_format()

WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item* proto_tree_add_int64_format ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
gint64  value,
const char *  format,
  ... 
)

Add a formatted FT_INT64 to a proto_tree, with the format generating the entire string for the entry, including any field name.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
valuedata to display
formatprintf like format string
...printf like parameters
Returns
the newly created item

◆ proto_tree_add_int64_format_value()

WS_DLL_PUBLIC proto_item* proto_tree_add_int64_format_value ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
gint64  value,
const char *  format,
  ... 
)

Add a formatted FT_INT64 to a proto_tree, with the format generating the string for the value and with the field name being included automatically.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
valuedata to display
formatprintf like format string
...printf like parameters
Returns
the newly created item

◆ proto_tree_add_int_bits_format_value()

WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item proto_item proto_item* proto_tree_add_int_bits_format_value ( proto_tree tree,
const int  hf_index,
tvbuff_t tvb,
const guint  bit_offset,
const gint  no_of_bits,
gint32  value,
const guint  encoding,
const char *  format,
  ... 
)

Add bits for a FT_INT8, FT_INT16, FT_INT24 or FT_INT32 header field to a proto_tree, with the format generating the string for the value and with the field name being included automatically.

Parameters
treethe tree to append this item to
hf_indexfield index
tvbthe tv buffer of the current data
bit_offsetstart of data in tvb expressed in bits
no_of_bitslength of data in tvb expressed in bit
valuedata to display
encodingdata encoding
formatprintf like format string
...printf like parameters
Returns
the newly created item

◆ proto_tree_add_int_format()

WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item* proto_tree_add_int_format ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
gint32  value,
const char *  format,
  ... 
)

Add a formatted FT_INT8, FT_INT16, FT_INT24 or FT_INT32 to a proto_tree, with the format generating the entire string for the entry, including any field name.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
valuedata to display
formatprintf like format string
...printf like parameters
Returns
the newly created item

◆ proto_tree_add_int_format_value()

WS_DLL_PUBLIC proto_item* proto_tree_add_int_format_value ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
gint32  value,
const char *  format,
  ... 
)

Add a formatted FT_INT8, FT_INT16, FT_INT24 or FT_INT32 to a proto_tree, with the format generating the string for the value and with the field name being included automatically.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
valuedata to display
formatprintf like format string
...printf like parameters
Returns
the newly created item

◆ proto_tree_add_ipv4()

WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item* proto_tree_add_ipv4 ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
ws_in4_addr  value 
)

Add a FT_IPv4 to a proto_tree.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
valuedata to display
Returns
the newly created item

◆ proto_tree_add_ipv4_format()

WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item* proto_tree_add_ipv4_format ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
ws_in4_addr  value,
const char *  format,
  ... 
)

Add a formatted FT_IPv4 to a proto_tree, with the format generating the entire string for the entry, including any field name.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
valuedata to display
formatprintf like format string
...printf like parameters
Returns
the newly created item

◆ proto_tree_add_ipv4_format_value()

WS_DLL_PUBLIC proto_item* proto_tree_add_ipv4_format_value ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
ws_in4_addr  value,
const char *  format,
  ... 
)

Add a formatted FT_IPv4 to a proto_tree, with the format generating the string for the value and with the field name being included automatically.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
valuedata to display
formatprintf like format string
...printf like parameters
Returns
the newly created item

◆ proto_tree_add_ipv6()

WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item* proto_tree_add_ipv6 ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
const ws_in6_addr value_ptr 
)

Add a FT_IPv6 to a proto_tree.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
value_ptrdata to display
Returns
the newly created item

◆ proto_tree_add_ipv6_format()

WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item* proto_tree_add_ipv6_format ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
const ws_in6_addr value_ptr,
const char *  format,
  ... 
)

Add a formatted FT_IPv6 to a proto_tree, with the format generating the entire string for the entry, including any field name.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
value_ptrdata to display
formatprintf like format string
...printf like parameters
Returns
the newly created item

◆ proto_tree_add_ipv6_format_value()

WS_DLL_PUBLIC proto_item* proto_tree_add_ipv6_format_value ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
const ws_in6_addr value_ptr,
const char *  format,
  ... 
)

Add a formatted FT_IPv6 to a proto_tree, with the format generating the string for the value and with the field name being included automatically.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
value_ptrdata to display
formatprintf like format string
...printf like parameters
Returns
the newly created item

◆ proto_tree_add_ipxnet()

WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item* proto_tree_add_ipxnet ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
guint32  value 
)

Add a FT_IPXNET to a proto_tree.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
valuedata to display
Returns
the newly created item

◆ proto_tree_add_ipxnet_format()

WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item* proto_tree_add_ipxnet_format ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
guint32  value,
const char *  format,
  ... 
)

Add a formatted FT_IPXNET to a proto_tree, with the format generating the entire string for the entry, including any field name.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
valuedata to display
formatprintf like format string
...printf like parameters
Returns
the newly created item

◆ proto_tree_add_ipxnet_format_value()

WS_DLL_PUBLIC proto_item* proto_tree_add_ipxnet_format_value ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
guint32  value,
const char *  format,
  ... 
)

Add a formatted FT_IPXNET to a proto_tree, with the format generating the string for the value and with the field name being included automatically.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
valuedata to display
formatprintf like format string
...printf like parameters
Returns
the newly created item

◆ proto_tree_add_item_new()

WS_DLL_PUBLIC proto_item* proto_tree_add_item_new ( proto_tree tree,
header_field_info hfinfo,
tvbuff_t tvb,
const gint  start,
gint  length,
const guint  encoding 
)

Add an item to a proto_tree, using the text label registered to that item. The item is extracted from the tvbuff handed to it.

Parameters
treethe tree to append this item to
hfinfofield
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
encodingdata encoding
Returns
the newly created item

◆ proto_tree_add_item_new_ret_length()

WS_DLL_PUBLIC proto_item* proto_tree_add_item_new_ret_length ( proto_tree tree,
header_field_info hfinfo,
tvbuff_t tvb,
const gint  start,
gint  length,
const guint  encoding,
gint *  lenretval 
)

Add an item to a proto_tree, using the text label registered to that item. The item is extracted from the tvbuff handed to it.

Return the length of the item through the pointer.

Parameters
treethe tree to append this item to
hfinfofield
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
encodingdata encoding
[out]lenretvalpoints to a gint that will be set to the item length
Returns
the newly created item, and *lenretval is set to the item length

◆ proto_tree_add_item_ret_display_string()

WS_DLL_PUBLIC proto_item* proto_tree_add_item_ret_display_string ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
const gint  start,
gint  length,
const guint  encoding,
wmem_allocator_t scope,
char **  retval 
)

Add an string or byte array item to a proto_tree, using the text label registered to that item.

This provides a string that is a display representation of the value, similar to what proto_tree_add_item_ret_string() does.

Parameters
treethe tree to append this item to
hfindexfield
tvbthe tv buffer of the current data
startstart of data in tvb (cannot be negative)
lengthlength of data in tvb (for strings can be -1 for remaining)
encodingdata encoding (e.g, ENC_ASCII, ENC_UTF_8, etc.)
scopethe wmem scope to use to allocate the string
[out]retvalpoints to a guint8 * that will be set to point to the string value
Returns
the newly created item, *retval is set to the display string

◆ proto_tree_add_item_ret_display_string_and_length()

WS_DLL_PUBLIC proto_item* proto_tree_add_item_ret_display_string_and_length ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
const gint  start,
gint  length,
const guint  encoding,
wmem_allocator_t scope,
char **  retval,
gint *  lenretval 
)

Add an string or byte array item to a proto_tree, using the text label registered to that item.

This provides a string that is a display representation of the value, and the length of the item, similar to what proto_tree_add_item_ret_string_and_length() does.

Parameters
scopethe wmem scope to use to allocate the string
treethe tree to append this item to
hfindexfield
tvbthe tv buffer of the current data
startstart of data in tvb (cannot be negative)
lengthlength of data in tvb (for strings can be -1 for remaining)
encodingdata encoding (e.g, ENC_ASCII, ENC_UTF_8, etc.)
[out]retvalpoints to a guint8 * that will be set to point to the string value
[out]lenretvalpoints to a gint that will be set to the item length
Returns
the newly created item, *retval is set to the display string, and *lenretval is set to the item length

◆ proto_tree_add_item_ret_double()

WS_DLL_PUBLIC proto_item* proto_tree_add_item_ret_double ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
const gint  start,
gint  length,
const guint  encoding,
gdouble *  retval 
)

Parse a double from the buffer and add it to the tree, returning the item added and the parsed value via retval.

Parameters
treethe tree
hfindexthe field
tvbthe tv buffer
startstart index of data in tvb
lengthlength of data. calls REPORT_DISSECTOR_BUG if not equal to 8
encodingENC_LITTLE_ENDIAN or ENC_BIG_ENDIAN
[out]retvalfor the decoded value
Returns
the newly created item and retval is set to the decoded value

◆ proto_tree_add_item_ret_ether()

WS_DLL_PUBLIC proto_item* proto_tree_add_item_ret_ether ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
const gint  start,
gint  length,
const guint  encoding,
guint8 *  retval 
)

Parse an ethernet address from the buffer and add it to the tree, writing the value to the pointer specified by the caller. The pointer must not be null.

Parameters
treethe tree
hfindexthe field
tvbthe tv buffer
startthe start index of data in tvb
lengththe length of data. calls REPORT_DISSECTOR_BUG if not equal to FT_ETHER_LEN
encodingencodings not yet supported. calls REPORT_DISSECTOR_BUG if not equal to 0
retvala buffer of at least FT_ETHER_LEN bytes for the address, must not be null
Returns
the newly created item

◆ proto_tree_add_item_ret_float()

WS_DLL_PUBLIC proto_item* proto_tree_add_item_ret_float ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
const gint  start,
gint  length,
const guint  encoding,
gfloat *  retval 
)

Parse a float from the buffer and add it to the tree, returning the item added and the parsed value via retval.

Parameters
treethe tree
hfindexthe field
tvbthe tv buffer
startstart index of data in tvb
lengththe length of data. calls REPORT_DISSECTOR_BUG if not equal to 4
encodingENC_LITTLE_ENDIAN or ENC_BIG_ENDIAN
[out]retvalfor the decoded value
Returns
the newly created item

◆ proto_tree_add_item_ret_int()

WS_DLL_PUBLIC proto_item* proto_tree_add_item_ret_int ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
const gint  start,
gint  length,
const guint  encoding,
gint32 *  retval 
)

Add an integer data item to a proto_tree, using the text label registered to that item. The item is extracted from the tvbuff handed to it, and the retrieved value is also set to *retval so the caller gets it back for other uses.

This function retrieves the value even if the passed-in tree param is NULL, so that it can be used by dissectors at all times to both get the value and set the tree item to it.

Like other proto_tree_add functions, if there is a tree and the value cannot be decoded from the tvbuff, then an expert info error is reported.

This function accepts ENC_LITTLE_ENDIAN and ENC_BIG_ENDIAN for native number encoding in the tvbuff

The length argument must be set to the appropriate size of the native type as in other proto_add routines.

Integers of 8, 16, 24 and 32 bits can be retrieved with the _ret_int and ret_uint functions; integers of 40, 48, 56, and 64 bits can be retrieved with the _ret_uint64 function; Boolean values of 8, 16, 24, 32, 40, 48, 56, and 64 bits can be retrieved with the _ret_boolean function.

Parameters
treethe tree to append this item to
hfindexfield
tvbthe tv buffer of the current data
startstart of data in tvb (cannot be negative)
lengthlength of data in tvb (for strings can be -1 for remaining)
encodingdata encoding (e.g, ENC_LITTLE_ENDIAN, ENC_BIG_ENDIAN, ENC_ASCII|ENC_STRING, etc.)
[out]retvalpoints to a gint32 or guint32 which will be set to the value
Returns
the newly created item, and *retval is set to the decoded value masked/shifted according to bitmask

◆ proto_tree_add_item_ret_ipv6()

WS_DLL_PUBLIC proto_item* proto_tree_add_item_ret_ipv6 ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
const gint  start,
gint  length,
const guint  encoding,
ws_in6_addr retval 
)

Parse an ipv6 address from the buffer and add it to the tree, writing the value to the pointer specified by the caller. The pointer must not be null.

Parameters
treethe tree
hfindexthe field
tvbthe tv buffer
startthe start index of data in tvb
lengththe length of data. calls REPORT_DISSECTOR_BUG if not equal to FT_IPv6_LEN
encodingencodings not yet supported. calls REPORT_DISSECTOR_BUG if not equal to 0
retvalwhere the address should be written, must not be null
Returns
the newly created item

◆ proto_tree_add_item_ret_string()

WS_DLL_PUBLIC proto_item* proto_tree_add_item_ret_string ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
const gint  start,
gint  length,
const guint  encoding,
wmem_allocator_t scope,
const guint8 **  retval 
)

Add an string item to a proto_tree, using the text label registered to that item.

The item is extracted from the tvbuff handed to it, and the retrieved value is returned through a pointer so the caller can use it. The value is allocated using the wmem scope passed in.

This function retrieves the value even if the passed-in tree param is NULL, so that it can be used by dissectors at all times to both get the value and set the tree item to it.

Like other proto_tree_add functions, if there is a tree and the value cannot be decoded from the tvbuff, then an expert info error is reported.

This function accepts string encodings.

Parameters
scopethe wmem scope to use to allocate the string
treethe tree to append this item to
hfindexfield
tvbthe tv buffer of the current data
startstart of data in tvb (cannot be negative)
lengthlength of data in tvb (for strings can be -1 for remaining)
encodingdata encoding (e.g, ENC_ASCII, ENC_UTF_8, etc.)
[out]retvalpoints to a guint8 * that will be set to point to the string value
Returns
the newly created item, and *retval is set to the decoded value

◆ proto_tree_add_item_ret_string_and_length()

WS_DLL_PUBLIC proto_item* proto_tree_add_item_ret_string_and_length ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
const gint  start,
gint  length,
const guint  encoding,
wmem_allocator_t scope,
const guint8 **  retval,
gint *  lenretval 
)

Add an string item to a proto_tree, using the text label registered to that item.

The item is extracted from the tvbuff handed to it, and the retrieved value and its length are returned through pointers so the caller can use them. The value is allocated using the wmem scope passed in.

This function retrieves the value and length even if the passed-in tree param is NULL, so that then can be used by dissectors at all times to both get the value and set the tree item to it.

Like other proto_tree_add functions, if there is a tree and the value cannot be decoded from the tvbuff, then an expert info error is reported.

This function accepts string encodings.

Parameters
scopethe wmem scope to use to allocate the string
treethe tree to append this item to
hfindexfield
tvbthe tv buffer of the current data
startstart of data in tvb (cannot be negative)
lengthlength of data in tvb (for strings can be -1 for remaining)
encodingdata encoding (e.g, ENC_ASCII, ENC_UTF_8, etc.)
[out]retvalpoints to a guint8 * that will be set to point to the string value
[out]lenretvalpoints to a gint that will be set to the item length
Returns
the newly created item, *retval is set to the decoded value, and *lenretval is set to the item length

◆ proto_tree_add_item_ret_time_string()

WS_DLL_PUBLIC proto_item* proto_tree_add_item_ret_time_string ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
const gint  start,
gint  length,
const guint  encoding,
wmem_allocator_t scope,
char **  retval 
)

Add a time item to a proto_tree, using thetext label registered to that item.

This provides a string that is a display representation of the time value

Parameters
treethe tree to append this item to
hfindexfield
tvbthe tv buffer of the current data
startstart of data in tvb (cannot be negative)
lengthlength of data in tvb (for strings can be -1 for remaining)
encodingdata encoding (e.g, ENC_ASCII, ENC_UTF_8, etc.)
scopethe wmem scope to use to allocate the string
[out]retvalpoints to a guint8 * that will be set to point to the string value
Returns
the newly created item, *retval is set to the display string

◆ proto_tree_add_mac48_detail()

WS_DLL_PUBLIC proto_item* proto_tree_add_mac48_detail ( const mac_hf_list_t list_specific,
const mac_hf_list_t list_generic,
gint  idx,
tvbuff_t tvb,
proto_tree tree,
gint  offset 
)

Add a MAC-48 (Ethernet) address to a proto_tree from the tvb. Handles full and OUI resolution, IG and LG bits, and hidden generic fields, all as a subtree of the address item.

Parameters
list_specificthe mac_hf_list_t with field indexes for the specific addr type
list_genericthe mac_hf_list_t with field indexes for the generic addr type
idxone of the ett_ array elements registered with proto_register_subtree_array()
tvbthe tv buffer of the current data
treethe tree to append this item to
offsetstart of data in tvb representing the MAC-48 address

◆ proto_tree_add_none_format()

WS_DLL_PUBLIC proto_item* proto_tree_add_none_format ( proto_tree tree,
const int  hfindex,
tvbuff_t tvb,
const gint  start,
gint  length,
const char *  format,
  ... 
)

Add a FT_NONE field to a proto_tree.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
formatprintf like format string
...printf like parameters
Returns
the newly created item

◆ proto_tree_add_oid()

WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item* proto_tree_add_oid ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
const guint8 *  value_ptr 
)

Add a FT_OID to a proto_tree.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
value_ptrdata to display
Returns
the newly created item

◆ proto_tree_add_oid_format()

WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item* proto_tree_add_oid_format ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
const guint8 *  value_ptr,
const char *  format,
  ... 
)

Add a formatted FT_OID to a proto_tree, with the format generating the entire string for the entry, including any field name.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
value_ptrdata to display
formatprintf like format string
...printf like parameters
Returns
the newly created item

◆ proto_tree_add_oid_format_value()

WS_DLL_PUBLIC proto_item* proto_tree_add_oid_format_value ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
const guint8 *  value_ptr,
const char *  format,
  ... 
)

Add a formatted FT_OID to a proto_tree, with the format generating the string for the value and with the field name being included automatically.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
value_ptrdata to display
formatprintf like format string
...printf like parameters
Returns
the newly created item

◆ proto_tree_add_protocol_format()

WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item* proto_tree_add_protocol_format ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
const char *  format,
  ... 
)

Add a FT_PROTOCOL to a proto_tree.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
formatprintf like format string
...printf like parameters
Returns
the newly created item

◆ proto_tree_add_split_bits_crumb()

void proto_tree_add_split_bits_crumb ( proto_tree tree,
const int  hf_index,
tvbuff_t tvb,
const guint  bit_offset,
const crumb_spec_t crumb_spec,
guint16  crumb_index 
)

Add bitmap text for a split-bits crumb to a proto_tree, using the text label registered to an item. The bitmap is extracted from the tvbuff handed to it as a crumb (segment) of contiguous bits, specified by one of an array of crumb_spec elements. This function is normally called once per crumb, after the call to proto_tree_add_split_bits_item_ret_val

Parameters
treethe tree to append this item to
hf_indexfield index. Fields for use with this function should have bitmask==0.
tvbthe tv buffer of the current data
bit_offsetof the first crumb in tvb expressed in bits
crumb_specpointer to crumb_spec array
crumb_indexinto the crumb_spec array for this crumb

◆ proto_tree_add_split_bits_item_ret_val()

WS_DLL_PUBLIC proto_item* proto_tree_add_split_bits_item_ret_val ( proto_tree tree,
const int  hf_index,
tvbuff_t tvb,
const guint  bit_offset,
const crumb_spec_t crumb_spec,
guint64 *  return_value 
)

Add bits to a proto_tree, using the text label registered to that item. The item is extracted from the tvbuff handed to it as a set of crumbs (segments) of contiguous bits, specified by an array of crumb_spec elements. The crumbs are assembled to create the value. There may be any number of crumbs specifying up to a total of 64 bits which may occur anywhere within the tvb. If the span of the crumbs within the tvb is 4 octets or less, a bitmap of the crumbs is produced.

Parameters
treethe tree to append this item to
hf_indexfield index. Fields for use with this function should have bitmask==0.
tvbthe tv buffer of the current data
bit_offsetof the first crumb in tvb expressed in bits
crumb_specpointer to crumb_spec array
return_valueif a pointer is passed here the value is returned.
Returns
the newly created item

◆ proto_tree_add_string()

WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item* proto_tree_add_string ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
const char *  value 
)

Add an FT_STRING, FT_STRINGZ, FT_STRINGZPAD, or FT_STRINGZTRUNC to a proto_tree. The value passed in should be a UTF-8 encoded null terminated string, such as produced by tvb_get_string_enc(), regardless of the original packet data.

This function is used to add a custom string value to the protocol tree. Do not format the string value for display, for example by using format_text(). The input string represents packet data, not a display label. Formatting labels is a concern of the UI. Doing that here would change the meaning of the packet data, restrict the options for formatting later and make display filtering unintuitive for whitespace and other special characters.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
valuedata to display
Returns
the newly created item

◆ proto_tree_add_string_format()

WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item* proto_tree_add_string_format ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
const char *  value,
const char *  format,
  ... 
)

Add a formatted FT_STRING, FT_STRINGZ, FT_STRINGZPAD, or FT_STRINGZTRUNC to a proto_tree, with the format generating the entire string for the entry, including any field name.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
valuedata to display
formatprintf like format string
...printf like parameters
Returns
the newly created item

◆ proto_tree_add_string_format_value()

WS_DLL_PUBLIC proto_item* proto_tree_add_string_format_value ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
const char *  value,
const char *  format,
  ... 
)

Add a formatted FT_STRING, FT_STRINGZ, FT_STRINGZPAD, or FT_STRINGZTRUNC to a proto_tree, with the format generating the string for the value and with the field name being included automatically.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
valuedata to display
formatprintf like format string
...printf like parameters
Returns
the newly created item

◆ proto_tree_add_subtree()

proto_item proto_item WS_DLL_PUBLIC proto_tree* proto_tree_add_subtree ( proto_tree tree,
tvbuff_t tvb,
gint  start,
gint  length,
gint  idx,
proto_item **  tree_item,
const char *  text 
)

Add a text-only node that creates a subtree underneath.

Parameters
treethe tree to append this item to
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
idxone of the ett_ array elements registered with proto_register_subtree_array()
tree_itemitem returned with tree creation. Can be NULL if going to be unused
textlabel for the tree
Returns
the newly created tree

◆ proto_tree_add_subtree_format()

WS_DLL_PUBLIC proto_tree* proto_tree_add_subtree_format ( proto_tree tree,
tvbuff_t tvb,
gint  start,
gint  length,
gint  idx,
proto_item **  tree_item,
const char *  format,
  ... 
)

Add a text-only node that creates a subtree underneath.

Parameters
treethe tree to append this item to
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
idxone of the ett_ array elements registered with proto_register_subtree_array()
tree_itemitem returned with tree creation. Can be NULL if going to be unused
formatprintf like format string
...printf like parameters
Returns
the newly created tree

◆ proto_tree_add_text_internal()

proto_item* proto_tree_add_text_internal ( proto_tree tree,
tvbuff_t tvb,
gint  start,
gint  length,
const char *  format,
  ... 
)

(INTERNAL USE ONLY) Add a text-only node to a proto_tree.

Parameters
treethe tree to append this item to
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
formatprintf like format string
...printf like parameters
Returns
the newly created item

◆ proto_tree_add_text_valist_internal()

proto_item proto_item* proto_tree_add_text_valist_internal ( proto_tree tree,
tvbuff_t tvb,
gint  start,
gint  length,
const char *  format,
va_list  ap 
)

(INTERNAL USE ONLY) Add a text-only node to a proto_tree using a variable argument list.

Parameters
treethe tree to append this item to
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
formatprintf like format string
apvariable argument list
Returns
the newly created item

◆ proto_tree_add_time()

WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item* proto_tree_add_time ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
const nstime_t value_ptr 
)

Add a FT_ABSOLUTE_TIME or FT_RELATIVE_TIME to a proto_tree.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
value_ptrpointer to the data to display
Returns
the newly created item

◆ proto_tree_add_time_format()

WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item* proto_tree_add_time_format ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
nstime_t value_ptr,
const char *  format,
  ... 
)

Add a formatted FT_ABSOLUTE_TIME or FT_RELATIVE_TIME to a proto_tree, with the format generating the entire string for the entry, including any field name.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
value_ptrpointer to the data to display
formatprintf like format string
...printf like parameters
Returns
the newly created item

◆ proto_tree_add_time_format_value()

WS_DLL_PUBLIC proto_item* proto_tree_add_time_format_value ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
nstime_t value_ptr,
const char *  format,
  ... 
)

Add a formatted FT_ABSOLUTE_TIME or FT_RELATIVE_TIME to a proto_tree, with the format generating the string for the value and with the field name being included automatically.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
value_ptrpointer to the data to display
formatprintf like format string
...printf like parameters
Returns
the newly created item

◆ proto_tree_add_time_item()

WS_DLL_PUBLIC proto_item* proto_tree_add_time_item ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
const gint  start,
gint  length,
const guint  encoding,
nstime_t retval,
gint *  endoff,
gint *  err 
)

Get and add a FT_ABSOLUTE_TIME or FT_RELATIVE_TIME to a proto_tree. The item is extracted from the tvbuff handed to it, based on the ENC_* passed in for the encoding, and the retrieved value is also set to *retval so the caller gets it back for other uses.

This function retrieves the value even if the passed-in tree param is NULL, so that it can be used by dissectors at all times to both get the value and set the tree item to it.

Like other proto_tree_add functions, if there is a tree and the value cannot be decoded from the tvbuff, then an expert info error is reported. For string encoding, this means that a failure to decode the time value from the string results in an expert info error being added to the tree.

If encoding is string-based, it will convert using tvb_get_string_time(); see that function's comments for details.

Note
The nstime_t *retval must be pre-allocated as a nstime_t.
Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
encodingdata encoding (e.g, ENC_LITTLE_ENDIAN, ENC_UTF_8|ENC_ISO_8601_DATE_TIME, etc.)
[in,out]retvalpoints to a nstime_t which will be set to the value
[in,out]endoffif not NULL, gets set to the character after those consumed.
[in,out]errif not NULL, gets set to 0 if no failure, else EINVAL.
Returns
the newly created item, and retval is set to the decoded value

◆ proto_tree_add_ts_23_038_7bits_packed_item()

WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item proto_item proto_item proto_item proto_item WS_DLL_PUBLIC proto_item* proto_tree_add_ts_23_038_7bits_packed_item ( proto_tree tree,
const int  hfindex,
tvbuff_t tvb,
const guint  bit_offset,
const gint  no_of_chars 
)

Add a FT_STRING with ENC_3GPP_TS_23_038_7BITS_PACKED encoding to a proto_tree.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
bit_offsetstart of data in tvb expressed in bits
no_of_charsnumber of 7bits characters to display
Returns
the newly created item

◆ proto_tree_add_uint()

WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item* proto_tree_add_uint ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
guint32  value 
)

Add one of FT_UINT8, FT_UINT16, FT_UINT24 or FT_UINT32 to a proto_tree.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
valuedata to display
Returns
the newly created item

◆ proto_tree_add_uint64()

WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item* proto_tree_add_uint64 ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
guint64  value 
)

Add an FT_UINT64 to a proto_tree.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
valuedata to display
Returns
the newly created item

◆ proto_tree_add_uint64_bits_format_value()

WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item* proto_tree_add_uint64_bits_format_value ( proto_tree tree,
const int  hf_index,
tvbuff_t tvb,
const guint  bit_offset,
const gint  no_of_bits,
guint64  value,
const guint  encoding,
const char *  format,
  ... 
)

Add bits for a FT_UINT8, FT_UINT16, FT_UINT24 or FT_UINT32 header field to a proto_tree, with the format generating the string for the value and with the field name being included automatically.

Parameters
treethe tree to append this item to
hf_indexfield index
tvbthe tv buffer of the current data
bit_offsetstart of data in tvb expressed in bits
no_of_bitslength of data in tvb expressed in bit
valuedata to display
encodingdata encoding
formatprintf like format string
Returns
the newly created item

◆ proto_tree_add_uint64_format()

WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item* proto_tree_add_uint64_format ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
guint64  value,
const char *  format,
  ... 
)

Add a formatted FT_UINT64 to a proto_tree, with the format generating the entire string for the entry, including any field name.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
valuedata to display
formatprintf like format string
...printf like parameters
Returns
the newly created item

◆ proto_tree_add_uint64_format_value()

WS_DLL_PUBLIC proto_item* proto_tree_add_uint64_format_value ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
guint64  value,
const char *  format,
  ... 
)

Add a formatted FT_UINT64 to a proto_tree, with the format generating the string for the value and with the field name being included automatically.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
valuedata to display
formatprintf like format string
...printf like parameters
Returns
the newly created item

◆ proto_tree_add_uint_bits_format_value()

WS_DLL_PUBLIC proto_item* proto_tree_add_uint_bits_format_value ( proto_tree tree,
const int  hf_index,
tvbuff_t tvb,
const guint  bit_offset,
const gint  no_of_bits,
guint32  value,
const guint  encoding,
const char *  format,
  ... 
)

Add bits for a FT_UINT8, FT_UINT16, FT_UINT24 or FT_UINT32 header field to a proto_tree, with the format generating the string for the value and with the field name being included automatically.

Parameters
treethe tree to append this item to
hf_indexfield index
tvbthe tv buffer of the current data
bit_offsetstart of data in tvb expressed in bits
no_of_bitslength of data in tvb expressed in bit
valuedata to display
encodingdata encoding
formatprintf like format string
Returns
the newly created item

◆ proto_tree_add_uint_format()

WS_DLL_PUBLIC proto_item WS_DLL_PUBLIC proto_item* proto_tree_add_uint_format ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
guint32  value,
const char *  format,
  ... 
)

Add a formatted FT_UINT8, FT_UINT16, FT_UINT24 or FT_UINT32 to a proto_tree, with the format generating the entire string for the entry, including any field name.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
valuedata to display
formatprintf like format string
...printf like parameters
Returns
the newly created item

◆ proto_tree_add_uint_format_value()

WS_DLL_PUBLIC proto_item* proto_tree_add_uint_format_value ( proto_tree tree,
int  hfindex,
tvbuff_t tvb,
gint  start,
gint  length,
guint32  value,
const char *  format,
  ... 
)

Add a formatted FT_UINT8, FT_UINT16, FT_UINT24 or FT_UINT32 to a proto_tree, with the format generating the string for the value and with the field name being included automatically.

Parameters
treethe tree to append this item to
hfindexfield index
tvbthe tv buffer of the current data
startstart of data in tvb
lengthlength of data in tvb
valuedata to display
formatprintf like format string
...printf like parameters
Returns
the newly created item

◆ proto_tree_create_root()

proto_tree* proto_tree_create_root ( struct _packet_info pinfo)

Creates a new proto_tree root.

Returns
the new tree root

◆ proto_tree_free()

WS_DLL_PUBLIC void proto_tree_free ( proto_tree tree)

Clear memory for entry proto_tree. Clears proto_tree struct also.

Parameters
treethe tree to free

◆ proto_tree_get_parent()

WS_DLL_PUBLIC proto_item* proto_tree_get_parent ( proto_tree tree)

Get a parent item of a subtree.

Parameters
treethe tree to get the parent from
Returns
parent item

◆ proto_tree_get_parent_tree()

WS_DLL_PUBLIC proto_tree* proto_tree_get_parent_tree ( proto_tree tree)

Get the parent tree of a subtree.

Parameters
treethe tree to get the parent from
Returns
parent tree

◆ proto_tree_get_root()

WS_DLL_PUBLIC proto_tree* proto_tree_get_root ( proto_tree tree)

Get the root tree from any subtree.

Parameters
treethe tree to get the root from
Returns
root tree

◆ proto_tree_move_item()

WS_DLL_PUBLIC void proto_tree_move_item ( proto_tree tree,
proto_item fixed_item,
proto_item item_to_move 
)

Move an existing item behind another existing item.

Parameters
treethe tree to which both items belong
fixed_itemthe item which keeps its position
item_to_movethe item which will be moved

◆ proto_tree_prime_with_hfid()

void proto_tree_prime_with_hfid ( proto_tree tree,
const int  hfid 
)

Mark a field/protocol ID as "interesting". That means that we don't fake the item (because we are filtering on it), and we mark its parent protocol (if any) as being indirectly referenced (so proto_field_is_referenced() will return TRUE for the protocol as well.)

Parameters
treethe tree to be set (currently ignored)
hfidthe interesting field id

◆ proto_tree_prime_with_hfid_print()

void proto_tree_prime_with_hfid_print ( proto_tree tree,
const int  hfid 
)

Mark a field/protocol ID as something we want to print. That means that we don't fake it, and we also don't hide it by default even if the tree isn't visible.

Parameters
treethe tree to be set (currently ignored)
hfidthe field id

◆ proto_tree_set_appendix()

WS_DLL_PUBLIC void proto_tree_set_appendix ( proto_tree tree,
tvbuff_t tvb,
gint  start,
const gint  length 
)

Set start and length of an appendix for a proto_tree.

Parameters
treethe tree to set the appendix start and length
tvbthe tv buffer of the current data
startthe start offset of the appendix
lengththe length of the appendix

◆ proto_tree_set_fake_protocols()

void proto_tree_set_fake_protocols ( proto_tree tree,
gboolean  fake_protocols 
)

Indicate whether we should fake protocols during dissection (default = TRUE)

Parameters
treethe tree to be set
fake_protocolsTRUE if we should fake protocols

◆ proto_tree_set_visible()

WS_DLL_PUBLIC gboolean proto_tree_set_visible ( proto_tree tree,
gboolean  visible 
)

Set the tree visible or invisible. Is the parsing being done for a visible proto_tree or an invisible one? By setting this correctly, the proto_tree creation is sped up by not having to call vsnprintf and copy strings around.

Parameters
treethe tree to be set
visible... or not
Returns
the old value

◆ tree_expanded()

WS_DLL_PUBLIC gboolean tree_expanded ( int  tree_type)

Returns TRUE if subtrees of that type are to be expanded.

◆ tree_expanded_set()

WS_DLL_PUBLIC void tree_expanded_set ( int  tree_type,
gboolean  value 
)

Sets if subtrees of that type are to be expanded.

Variable Documentation

◆ hf_text_only

WS_DLL_PUBLIC int hf_text_only

The header-field index for the special text pseudo-field. Exported by libwireshark.dll

◆ num_tree_types

WS_DLL_PUBLIC int num_tree_types

Number of elements in the tree_is_expanded array. With MSVC and a libwireshark.dll, we need a special declaration.