Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] VALS() with populated "unknown string"

From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
Date: Mon, 16 Sep 2013 15:14:43 -0400
On 09/16/13 06:49, mmann78@xxxxxxxxxxxx wrote:
Is there a way to provide the "unknown string" for the val_to_str call
made in hf_ registration (ie some derivation of the VALS() macro)?
There are many proto_tree_add_[u]int_format[_value] calls that are done
strictly to provided an "unknown string" for the val_to_str that is
different than the default of "Unknown".  If there was such a way, many
of these calls could be converted to proto_tree_add_item or
proto_tree_add_[u]int.
If there isn't such a thing, how easy/hard would it be to implement?

Would most if not all of those be satisfied by changing the current "Unknown" string to "Unknown %d" or "Unknown 0x%x" (depending on the hf's BASE_)?

Should we be doing that by default anyway?

(That would mean we'd end up using a lot more ep_ memory for the formatted string, but I'm not sure that's so bad.)


Another way I've seen this done is to append (proto_item_append_text()) the (custom) "unknown string" after the item is added.