Wireshark · Wireshark-dev: Re: [Wireshark-dev] tree view structuring

[Guy Harris <guy@xxxxxxxxxxxx>]

On Jan 5, 2011, at 6:53 PM, Brian Oleksa wrote:

       helen_item = proto_tree_add_item(tree, proto_helen, tvb, 0, -1, FALSE);
       helen_tree = proto_item_add_subtree(helen_item, ett_helen);
       helen_header_tree = proto_item_add_subtree(helen_item, ett_helen);

You're not putting anything into that tree, so there's no point in keeping it.  You're also attaching two subtrees to the same item; I don't think that does anything useful.

       helen_sub_item = proto_tree_add_item(helen_tree, hf_helen_checksum, tvb, offset, 8, FALSE);
       offset += 8;

       msecs_since_the_epoch = tvb_get_ntoh64(tvb, offset);
       t.secs = msecs_since_the_epoch / 1000;
       t.nsecs = (msecs_since_the_epoch % 1000)*1000000; /* milliseconds to nanoseconds */
       tmp = gmtime(&t.secs);

   if (tmp != NULL)
   {
       proto_tree_add_time_format(helen_tree, hf_helen_txTime, tvb, offset, 8, &t,
               "Date: %s %2d, %d %02d:%02d:%02d UTC", mon_names[tmp->tm_mon], tmp->tm_mday,
               tmp->tm_year + 1900, tmp->tm_hour, tmp->tm_min, tmp->tm_sec);
   }

       helen_header_tree = proto_item_add_subtree(helen_sub_item, ett_helen);

That will create a tree under the hf_helen_checksum tree item.  Is that what you want?  Checksums usually aren't very structured. :-)

Using ett_helen everywhere means that if you open any item for your protocol, the next time you click on a packet with data for your protocol, *every* subtree for your protocol will be opened up.  You might want to use separate items for separate trees.