ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] tree view structuring

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 5 Jan 2011 12:35:15 -0800
On Jan 5, 2011, at 12:02 PM, Brian Oleksa wrote:

> 
> I would like to do a little bit more structuring with my tree views.
> 
> Is it possible to have a tree within a tree..??

Yes.  proto_item_add_subtree() takes, as arguments, a proto_item * returned by a proto_tree_add_ routine, and an ett_ value, and returns a proto_tree * for a tree placed underneath the item added by the proto_tree_add_ call; you can add items to that tree.  This can be done to an arbitrary depth.

The ett_ value identifies a particular type of subtree; if you expand one of them, Wireshark keeps track of that and, when you click on another packet, it automatically opens all subtrees of that type.  If you close one of them, that gets turned off for that type.