Wireshark · Wireshark-dev: [Wireshark-dev] displaying header field without filtering capability

["John Dill" <John.Dill@xxxxxxxxxxxxxxxxx>]

Title: displaying header field without filtering capability

I'm trying to add a header field for spare bytes in a custom dissector.

Currently, I'm creating a header field for a 'Spare' data element in a 'Status' message, as shown in the example below:

\code snippet
{
  &hf_Spare,
  {
    "Spare",
    "msg.Status.Spare",
    FT_UINT8,
    BASE_HEX,
    NULL,
    0x0,
    "Spare",
    HFILL
  }
},
\endcode

Later I have a function that processes the 'Status' message components.

void dissect_message_Status(tvbuff_t* tvb, gint offset, proto_tree *tree)
{
  proto_tree_add_item(tree, hf_Field1, tvb, offset,     1, ENC_BIG_ENDIAN);
  proto_tree_add_item(tree, hf_Spare,  tvb, offset + 1, 1, ENC_BIG_ENDIAN);
  proto_tree_add_item(tree, hf_Field2, tvb, offset + 2, 2, ENC_BIG_ENDIAN);
}

Visually it works great in the Packet Details pane.  The issue is that I don't want to allow any filtering based on the 'Spare' data field when the user is editing a Filter _expression_.

What is the recommended method to handle this scenario?  Do I need to remove the hf_Spare structure from the hf_register_info array and use something like proto_tree_add_text?  I also see something about PROTO_ITEM_SET_HIDDEN, but it doesn't look like it applies.

Thanks,
John Dill