Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] VALS() with populated "unknown string"

Date: Mon, 16 Sep 2013 17:48:28 -0400 (EDT)
No, the issue is a dissector wants to use "reserved" or "Unknown <field name>", etc instead of the strict "Unknown".  Providing the numeric value that accompanies that enumeration is almost secondary.
 
I think Jakub's idea is a good one, just didn't know if we wanted to convert all (most) value_strings to value_strings_ext.  I thought the value_string_ext was more for a "large number of value strings", which won't always be the case.  But extending it with another value could allow us to put another string in for the "unknown".
 
-----Original Message-----
From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
To: Developer support list for Wireshark <wireshark-dev@xxxxxxxxxxxxx>
Sent: Mon, Sep 16, 2013 3:16 pm
Subject: Re: [Wireshark-dev] VALS() with populated "unknown string"

On 09/16/13 06:49, mmann78@xxxxxxxxxxxx wrote:
> Is there a way to provide the "unknown string" for the val_to_str call
> made in hf_ registration (ie some derivation of the VALS() macro)?
> There are many proto_tree_add_[u]int_format[_value] calls that are done
> strictly to provided an "unknown string" for the val_to_str that is
> different than the default of "Unknown".  If there was such a way, many
> of these calls could be converted to proto_tree_add_item or
> proto_tree_add_[u]int.
> If there isn't such a thing, how easy/hard would it be to implement?

Would most if not all of those be satisfied by changing the current 
"Unknown" string to "Unknown %d" or "Unknown 0x%x" (depending on the 
hf's BASE_)?

Should we be doing that by default anyway?

(That would mean we'd end up using a lot more ep_ memory for the 
formatted string, but I'm not sure that's so bad.)


Another way I've seen this done is to append (proto_item_append_text()) 
the (custom) "unknown string" after the item is added.

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe