ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] Filtering

From: "Maynard, Chris" <Christopher.Maynard@xxxxxxxxx>
Date: Tue, 31 Mar 2009 16:09:44 -0400
I would suggest reading through doc/README.developer and epan/proto.[h|c] and choosing the best proto_tree_add_xyz() call that meets your needs.  Maybe something like proto_tree_add_bytes() or proto_tree_add_item() will work for you, I don't know.  There are quite a number of them to choose from, so I'm pretty sure you'll find one that works for you.  And don't forget to look at other dissectors in epan/dissectors/ for some helpful examples.

> -----Original Message-----
> From: gogrady@xxxxxxxxx [mailto:gogrady@xxxxxxxxx]
> Sent: Tuesday, March 31, 2009 3:49 PM
> To: Developer support list for Wireshark
> Cc: Guy Harris; Maynard, Chris
> Subject: Re: [Wireshark-dev] Filtering
> 
> 
> >No, you can't do that.  hf_icom_message is, as per my earlier mail,
> >*NOT* the value of the field - it's just an index for that field in
> >Wireshark's table of all fields.
> 
> >If you want to filter on a field, the answer is simple - *DON'T* use
> >proto_tree_add_text() for it!
> 
> The thing is, i get all my information from a dll that i am going to
> output, the information is either char * or int. Is there a better
> function other than proto_tree_add_text() for adding this to the tree?
> 
> Thanks,
> Greg
CONFIDENTIALITY NOTICE: The contents of this email are confidential
and for the exclusive use of the intended recipient. If you receive this
email in error, please delete it from your system immediately and 
notify us either by email, telephone or fax. You should not copy,
forward, or otherwise disclose the content of the email.