Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Displaying a Manipulated string in the dissector.

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 2 Jun 2010 01:24:34 -0700
On Jun 1, 2010, at 11:24 PM, Craig Bumpstead wrote:

> I have a 256 Byte FT_STRING that holds address information. Is it possible to display that information in a human readable format? i.e Address, state etc in the dissector?

What does "manipulated" mean in this context?

Does it mean that

	1) the string isn't taken directly from the packet data, it's synthesized out of various other bits of information;

	2) the string *is* taken directly from the packet data, and has a bunch of information in it, and is parsed into address, state, etc.;

	3) something else?

If 1), I'd recommend *not* having the string as a data field itself, but to either put the individual items into the protocol tree directly, possibly under an FT_NONE field that shows a human-readable summary of the fields.

If 2), I'd suggest making the FT_STRING as a top-level item, and adding separate items underneath it for the various items you get from it when you parse it.  You *could* make the display representation of the FT_STRING be something other than the raw contents of the string (use proto_tree_add_string_format_value()).

If 3), well, it depends on what else it is....