Wireshark-dev: Re: [Wireshark-dev] ?????? how to display a packet in the packet_view?
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Sun, 23 Feb 2014 18:25:26 -0800
On Feb 23, 2014, at 5:12 PM, "??????????" <237825552@xxxxxx> wrote:

> thanks.you mean that the display operation is done in the dissector,right?

Wrong.

It's done by code in the ui/gtk directory for the GTK+ version and in code in the ui/qt directory for the Qt version.

What the dissector does is construct a protocol tree and set some address, port, and column values.

When the dissection is finished, the display code - which is *not* part of your dissector! - takes the address, port, and column values and, for custom columns, values from the protocol tree, and sets the columns of the packet list from that, and takes the protocol tree and sets the packet detail view.

> but i want to change the display infomation

What do you want to change?

> and what infomation will be display in the packet view,is that column_info?

The main Wireshark display has three sections:

	the packet list, which is where the column info shows up - there's one row in the packet list for each low-level packet;

	the packet details, which is where the protocol tree shows up - it shows the detailed dissection of whatever packet has been selected in the packet list;

	the hex dump - it shows the raw data being dissected for whatever packet has been selected in the packet list.