Andrew Schweitzer wrote:
> Thanks. Is it possible to define multiple arrays of fields, or is it
> common practice to just make one big one? One array per message might
> actually fit quite nicely with the way we have one data structure per
> message in code (more or less).
You *could* have multiple hf[] arrays and make multiple
proto_register_field_array() calls with the same protocol and different
arrays.
The common practice, however, is to define one array, even with
protocols that have one data structure per message. There is no
practical difference between calling proto_register_field_array() once
and calling it multiple times, other than the latter being slightly less
efficient; the structure of the protocol doesn't dictate the way you
register fields.
>>> Can you add a field list to a subtree?
>>
>> What do you mean by "field array" and "field list"?
>
> static hf_register_info hf[] = {
> ...
> }
>
> ...
>
> proto_register_field_array(proto_NEWPROTO, hf, array_length(hf));
>
> "hf" is I meant.
No, you cannot add an hf array to a subtree. You can only add fields
one at a time.
> Separate fields. Our protocol works more or less like this:
> [Fixed size header
> msg_id
> following_data_length]
> [data
> one packet OR
>
> count
> n fixed size packet OR
>
> count
> n variable size packet, each with their own length]
>
> Each packet has something like 10 different fields. Often the first
> three - five fields are common and the rest are not.
If the first 3-5 fields are common to multiple message types, you'd only
register each of those fields once, and use it in all of those message
types.
_______________________________________________
Wireshark-dev mailing list
[email protected]
http://www.wireshark.org/mailman/listinfo/wireshark-dev
