I'm trying to add a header field for spare bytes in a custom dissector.
Currently, I'm creating a header field for a 'Spare' data element in a 'Status'
message, as shown in the example below:
\code snippet
{
&hf_Spare,
{
"Spare",
"msg.Status.Spare",
FT_UINT8,
BASE_HEX,
NULL,
0x0,
"Spare",
HFILL
}
},
\endcode
Later I have a function that processes the 'Status' message components.
void dissect_message_Status(tvbuff_t* tvb, gint offset, proto_tree *tree)
{
proto_tree_add_item(tree, hf_Field1, tvb, offset, 1, ENC_BIG_ENDIAN);
proto_tree_add_item(tree, hf_Spare, tvb, offset + 1, 1, ENC_BIG_ENDIAN);
proto_tree_add_item(tree, hf_Field2, tvb, offset + 2, 2, ENC_BIG_ENDIAN);
}
Visually it works great in the Packet Details pane. The issue is that I don't
want to allow any filtering based on the 'Spare' data field when the user is
editing a Filter Expression.
What is the recommended method to handle this scenario? Do I need to remove
the hf_Spare structure from the hf_register_info array and use something like
proto_tree_add_text? I also see something about PROTO_ITEM_SET_HIDDEN, but it
doesn't look like it applies.
Thanks,
John Dill
___________________________________________________________________________
Sent via: Wireshark-dev mailing list <[email protected]>
Archives: http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
mailto:[email protected]?subject=unsubscribe
