Wireshark · Wireshark-dev: Re: [Wireshark-dev] Changing how the fields are displayed in the output of dissector

["Swapnil Barai (sbarai)" <sbarai@xxxxxxxxx>]

Hey,

So in the following code which is part of void
proto_register_PROTOABBREV(void), what should I enter in the fieldname.
I am asking this because in the printf format argument in the call to
proto_tree_add_*_format() I have already mentioned what I want to
display.

static hf_register_info hf[] = {
		{ &hf_PROTOABBREV_FIELDABBREV,
			{ "FIELDNAME",
"PROTOABBREV.FIELDABBREV",
			FIELDTYPE, FIELDBASE, FIELDCONVERT, BITMASK,
			"FIELDDESCR", HFILL }
		}
	};

Also the field that I am trying to manipulate just occupies 3 bits of an
octet. Thus I am using proto_tree_bytes_format() as I could not find any
other format function suitable. In the start_ptr argument of this I am
passing tvb_get_ptr(tvb,offset,length). Is this start_ptr right coz my
field doesn't occupy the whole byte, only last 3 bytes?

Thanks
Swapnil

-----Original Message-----
From: wireshark-dev-bounces@xxxxxxxxxxxxx
[mailto:wireshark-dev-bounces@xxxxxxxxxxxxx] On Behalf Of Jaap Keuter
Sent: Wednesday, July 15, 2009 11:13 AM
To: Developer support list for Wireshark
Subject: Re: [Wireshark-dev] Changing how the fields are displayed in
the output of dissector

Hi,

No, that's part of the proto tree item presentation code.
All you can do is use your own formatted presentations through 
proto_tree_add_*_format() calls.

Thanx,
Jaap

Swapnil Barai (sbarai) wrote:
> Oh, so is there any way to alter this standard presentation for my own
> dissector. 
> 
> Thanks for your help.
> 
> Swapnil
> 
> -----Original Message-----
> From: wireshark-dev-bounces@xxxxxxxxxxxxx
> [mailto:wireshark-dev-bounces@xxxxxxxxxxxxx] On Behalf Of Jaap Keuter
> Sent: Wednesday, July 15, 2009 10:56 AM
> To: Developer support list for Wireshark
> Subject: Re: [Wireshark-dev] Changing how the fields are displayed in
> the output of dissector
> 
> Hi,
> 
> That is the standard presentation for header fields registered with a
> BITMASK!=0
> 
> Thanx,
> Jaap
> 
> Swapnil Barai (sbarai) wrote:
>> Yes, that's right. But which part of the source code needs to be
>> manipulated here I am not sure of that. As in what part of code is
>> causing the 000... = to appear before Qualifier.
>>
>> -----Original Message-----
>> From: wireshark-dev-bounces@xxxxxxxxxxxxx
>> [mailto:wireshark-dev-bounces@xxxxxxxxxxxxx] On Behalf Of Jaap Keuter
>> Sent: Wednesday, July 15, 2009 10:45 AM
>> To: Developer support list for Wireshark
>> Subject: Re: [Wireshark-dev] Changing how the fields are displayed in
>> the output of dissector
>>
>> Hi,
>>
>> Not without changing the sourcecode.
>>
>> Thanx,
>> Jaap
>>
>> Swapnil Barai (sbarai) wrote:
>>>   
>>>
>>>       Hi
>>>
>>>  
>>>
>>>       This is a sample output of wireshark SCSI dissector.
>>>
>>>  
>>>
>>>        000.... = Qualifier: Device type is connected to logical unit
>> (0x00)
>>>  
>>>
>>>        Qualifier being a registered field in the SCSI dissector.
>>>
>>>       
>>>
>>>       Is there a way to make this output as  
>>>
>>>  
>>>
>>>       Qualifier: Device type is connected to logical unit (0x00)
>>>
>>>    
>>>
>>>       Thanks
>>>
>>>

________________________________________________________________________
___
Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
 
mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe