Wireshark-dev: Re: [Wireshark-dev] Proper use of proto_tree_add_string?
From: "kannoll" <[email protected]>
Date: Fri, 29 Jun 2007 12:44:34 -0400
That's a good idea, and I'll probably have a place to use it, but my
immediate problem is packets that end before expected, so there's nothing to
highlight in the data (because it's not there).


-----Original Message-----
From: [email protected]
[mailto:[email protected]] On Behalf Of Martin Mathieson
Sent: Friday, June 29, 2007 12:39 PM
To: Developer support list for Wireshark
Subject: Re: [Wireshark-dev] Proper use of proto_tree_add_string?

What about doing something like this (taken from the packet-cops.c) ?

      proto_item *ti;
      ti = proto_tree_add_text(tree, tvb, offset, len,
                                            "PEP Id is not a NULL terminated
ASCII string");
      expert_add_info_format(pinfo, ti, PI_MALFORMED, PI_NOTE,
                                           "PEP Id is not a NULL terminated
ASCII string");

This highlights the section of packet data where the problem lies, but
displays a string not taken from the packet data.  It also adds an expert
item, which makes the item easier to navigate to.

Hope this helps,

On 6/29/07, Jaap Keuter <[email protected]> wrote:
> How about: proto_tree_add_debug_text() ?
> Thanx,
> Jaap
> kannoll wrote:
> >
> >
> > I am running into some error conditions in decoding WLCCP and would 
> > like
> to
> > catch the error and print a nice message in the protocol tree at the 
> > point the error occurs and stop decoding at that point.
> >
> > I have the logic down, but I'm trying to understand the best way to 
> > place the "nice message" into the protocol tree. 
> > Proto_tree_add_string sounds
> like
> > the right function, but the arguments seem to indicate otherwise. I 
> > think proto_tree_add_string is going to add a string to the tree 
> > based on data that is pulled from the packet.
> >
> > In my case, though, I'm not basing my string on data that's in the
> > Instead, it's just a nice warning message that something is wrong 
> > with the packet format.
> >
> > What's the best way to handle this?
> _______________________________________________
> Wireshark-dev mailing list
> [email protected]
> http://www.wireshark.org/mailman/listinfo/wireshark-dev
Wireshark-dev mailing list
[email protected]