Wireshark-dev: Re: [Wireshark-dev] Register display filter / EIGRP dissector update
From: wsgd <[email protected]>
Date: Wed, 12 Aug 2009 20:37:29 +0200

You want to do a filter on what ?
- major integer value    ----------> add an integer field
- minor integer value    ----------> add an integer field
- "major.minor" text ----------> add a text field with proto_tree_add_string[_format[_value]]
Look at README.developer


Jochen Bartl a écrit :

I have spent the last 2 days with adding IPv6, Stub Routing  and
Authentication TLV support to the EIGRP dissector.

A lot of the proto_tree_add_text calls were replaced by
proto_tree_add_item, to make use of the display filter functionality.
However there are still some header fields, where special output
formatting is needed, like in line 569 (IOS Version, dissect_eigrp_sv).

        ios_rel_major = tvb_get_guint8(tvb, 0);
        ios_rel_minor = tvb_get_guint8(tvb, 1);
        proto_tree_add_text(tree, tvb, offset, 2, "IOS release version:
%u.%u", ios_rel_major, ios_rel_minor);

How can I register a display filter for a field, which was not added
with the proto_tree_add_item function?

If someone is intersted in testing the code, sample captures can be
found here: http://trac.secdev.org/scapy/wiki/PacketsSamples

Any feedback on the newly added code would be much appreciated. I'll
submit patch request on bugs.wireshark.org of course, when the code is
well tested and cleaned-up.

Thanks in advance.

Best Regards,

Sent via:    Wireshark-dev mailing list <[email protected]>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:[email protected]?subject=unsubscribe