Wireshark-dev: Re: [Wireshark-dev] Indicate [Generated] field on Display Filter Reference page
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: John Thacker <johnthacker@xxxxxxxxx>
Date: Sat, 14 Nov 2020 17:42:13 -0500
On Sat, Nov 14, 2020, 4:14 PM Guy Harris <gharris@xxxxxxxxx> wrote:

I.e., "generated" is a property of an instance of a field, not of a field; that's why the code sample you showed has a separate call to proto_item_set_generated().

That may not be the case for *all* fields that have generated instances, but there might be some fields that have both generated and non-generated instances.

For an example, take a look at packet-tftp.c

TFTP packets with the read request and write request opcodes contain a source or destination filename, respectively, and in those packets the corresponding fields are added without set_generated()

For packets with other opcodes, conversation tracking is used to add the source or destination filename, as appropriate, for the ongoing transfer, and there set_generated() is used because it's not actually in those packets.

John Thacker