Wireshark-dev: Re: [Wireshark-dev] newbie question about dissecting protocol with many message
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Sat, 02 Sep 2006 20:02:55 -0700
Andrew Schweitzer wrote:
Ok, I think I got it, thanks. So I guess the hf[] array is just a flat repository for information about how to display fields in the gui?
The hf[] array is a list of all the fields the dissector *could* use when dissecting a packet. It has nothing whatsoever to do with what it *will* use for any *particular* packet.
I suppose we use comments and field names (e.g. "field.subfield.subsubfield") to clarify what we are adding?
The field names are used in display filters, so you should choose field names suggestive of what the field represents.
A dissector developer can use comments for whatever purpose they want; there is no convention for using particular comments for hf[] array elements. 


so hf[] might look like this:
hf[] = {
//Header fields
.... - actual declarations -
//Msg type X fields
.... - actual declarations -
//Msg type X+1 fields
... - actual declarations -
It could look like that, yes. (This is a private dissector, I assume; if you want to submit it for inclusion in Wireshark, don't use C++/C99 comments - not all C compilers with which Wireshark is compiled accept them.)