Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] displaying header field without filtering

From: "John Dill" <John.Dill@xxxxxxxxxxxxxxxxx>
Date: Fri, 21 Feb 2014 16:36:30 -0500
>Message: 1
>Date: Fri, 21 Feb 2014 17:22:59 +0100
>From: Alexis La Goutte <alexis.lagoutte@xxxxxxxxx>
>To: Developer support list for Wireshark <wireshark-dev@xxxxxxxxxxxxx>
>Subject: Re: [Wireshark-dev] displaying header field without filtering
>Message-ID:
>	<CAHzrgZ=FGN0-ZcKRS5_rNm_d17DLaj5_tSkDtoRkiRCmMZ7OOw@xxxxxxxxxxxxxx>
>Content-Type: text/plain; charset="iso-8859-1"
>
>Hi,
>
>Why don't use FT_BYTES type ?

The FT_ type used to render the Spare bytes is not the root cause
of my issue.  There are probably several methods to render Spare
bytes in the Packet Details pane using FT_BYTES or FT_UINT*.

The key point is that populating a Spare data element in hf_register_info
using a header_field_info struct forces (to the best of my
knowledge) that field to appear in the Filter Expression dialog.
For my set of requirements, they want to see the Spare bytes in the
Packet Details pane for validation, but do not want to see them in
the Filter Expression dialog, as they are not data of interest to
engineers and there are a ton of unused or Spare data elements.

I can use proto_tree_add_text to do what I need manually, but it's
not as centralized and it seems in general not recommended for new
plugin development.

Best regards,
John Dill

[snip]

<<winmail.dat>>