Wireshark-dev: Re: [Wireshark-dev] newbie question about dissecting protocol with many message
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Sat, 02 Sep 2006 16:06:47 -0700
Andrew Schweitzer wrote:
Thanks. Is it possible to define multiple arrays of fields, or is it common practice to just make one big one? One array per message might actually fit quite nicely with the way we have one data structure per message in code (more or less).
You *could* have multiple hf[] arrays and make multiple proto_register_field_array() calls with the same protocol and different arrays.
The common practice, however, is to define one array, even with protocols that have one data structure per message. There is no practical difference between calling proto_register_field_array() once and calling it multiple times, other than the latter being slightly less efficient; the structure of the protocol doesn't dictate the way you register fields. 


Can you add a field list to a subtree?
What do you mean by "field array" and "field list"? 

static hf_register_info hf[] = {
...
}

...

proto_register_field_array(proto_NEWPROTO, hf, array_length(hf));

"hf" is I meant.
No, you cannot add an hf array to a subtree. You can only add fields one at a time. 


Separate fields. Our protocol works more or less like this:
[Fixed size header
	msg_id
	following_data_length]
[data
	one packet OR

	count
	n fixed size packet OR
	
	count
	n variable size packet, each with their own length]
Each packet has something like 10 different fields. Often the first three - five fields are common and the rest are not.
If the first 3-5 fields are common to multiple message types, you'd only register each of those fields once, and use it in all of those message types.