Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Subtree array purpose

From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
Date: Fri, 29 Apr 2011 16:58:30 -0400
Max wrote:
Can anybody please explain the purpose of subtree array (ett_...)?

I don't get why should i have several different etts in my dissector's
code, while there is no information assotiated with these integers.

Each ett_ stores information about whether the particular subtree created using that variable is expanded or not.

For example, if a GUI user expands subtree B (but not A or C) and if the 3 subtrees use different ett_ variables then when the user clicks on the next packet then only subtree B will be automatically expanded. I find this behavior extremely useful when I'm comparing information (hanging off that subtree) between packets.

If OTOH only one ett_ variable is used for all 3 subtrees then all 3 subtrees in the next packet will be either expanded or collapsed (depending on the last action of the user on the last packet--whether they last expanded a subtree or collapsed one).