static void
foo_to_str(char **buffer, ...
#define MAX_BUFFER x
- *buffer=ep_alloc(x);
+ *buffer=ep_alloc(MAX_BUFFER);
<fill in *buffer>
}
...
beginning of the column. The remainder of the work both functions do is
identical to what 'col_append_str' and 'col_append_fstr' do.
+1.5.8 The col_set_fence and col_prepend_fence_fstr functions.
+
+Sometimes a dissector may be called multiple times for different PDUs in the
+same frame (for example in the case of SCTP chunk bundling: several upper
+layer data packets may be contained in one SCTP packet). If the upper layer
+dissector calls 'col_set_str()' or 'col_clear()' on the Info column when it
+begins dissecting each of those PDUs then when the frame is fully dissected
+the Info column would contain only the string from the last PDU in the frame.
+The 'col_set_fence' function erects a "fence" in the column that prevents
+subsequent 'col_...' calls from clearing the data currently in that column.
+For example, the SCTP dissector calls 'col_set_fence' on the Info column
+after it has called any subdissectors for that chunk so that subdissectors
+of any subsequent chunks may only append to the Info column.
+'col_prepend_fence_fstr' prepends data before a fence (moving it if
+necessary). It will create a fence at the end of the prended data if the
+fence does not already exist.
+
1.6 Constructing the protocol tree.
The middle pane of the main window, and the topmost pane of a packet
If the field has a numeric rather than an enumerated type, the 'strings'
field would be set to NULL.
+If the field has a numeric type that might logically fit in ranges of values
+one can use a range_string struct.
+
+Thus a 'range_string' structure is a way to map ranges to strings.
+
+ typedef struct _range_string {
+ guint32 value_min;
+ guint32 value_max;
+ const gchar *strptr;
+ } range_string;
+
+For fields of that type, you would declare an array of "range_string"s:
+
+ static const range_string rvalstringname[] = {
+ { INTVAL_MIN1, INTVALMAX1, "Descriptive String 1" },
+ { INTVAL_MIN2, INTVALMAX2, "Descriptive String 2" },
+ { 0, 0, NULL }
+ };
+
+If INTVAL_MIN equals INTVAL_MAX for a given entry the range_string
+behavior collapses to the one of value_string.
+
FT_BOOLEANS have a default map of 0 = "False", 1 (or anything else) = "True".
Sometimes it is useful to change the labels for boolean values (e.g.,
to "Yes"/"No", "Fast"/"Slow", etc.). For these mappings, a struct called
-true_false_string is used. (This struct is new as of Wireshark 0.7.6).
+true_false_string is used.
typedef struct true_false_string {
char *true_string;
If the Boolean field is to be displayed as "False" or "True", the
'strings' field would be set to NULL.
+Wireshark predefines a whole range of ready made "true_false_string"s
+in tfs.h, included via packet.h.
+
bitmask
-------
If the field is a bitfield, then the bitmask is the mask which will
them; this permits the results of up to three calls to 'val_to_str' to
be passed as arguments to a routine using those strings.)
+1.7.2 match_strrval and rval_to_str.
+
+A dissector may need to convert a range of values to a string, using a
+'range_string' structure.
+
+'match_strrval()' will do that:
+
+ gchar*
+ match_strrval(guint32 val, const range_string *rs)
+
+It will look up the value 'val' in the 'range_string' table pointed to
+by 'rs', and return either the corresponding string, or NULL if the
+value could not be found in the table. Please note that its base
+behavior is inherited from match_strval().
+
+'rval_to_str()' can be used to generate a string for values not found in
+the table:
+
+ gchar*
+ rval_to_str(guint32 val, const range_string *rs, const char *fmt)
+
+If the value 'val' is found in the 'range_string' table pointed to by
+'rs', 'rval_to_str' will return the corresponding string; otherwise, it
+will use 'fmt' as an 'sprintf'-style format, with 'val' as an argument,
+to generate a string, and will return a pointer to that string. Please
+note that its base behavior is inherited from match_strval().
1.8 Calling Other Dissectors.
/* create the conversation with your data pointer */
- conversation_new(pinfo->fd->num, &pinfo->src, &pinfo->dst, pinfo->ptype,
+ conversation = conversation_new(pinfo->fd->num, &pinfo->src, &pinfo->dst, pinfo->ptype,
pinfo->srcport, pinfo->destport, 0);
conversation_add_proto_data(conversation, my_proto, (void *)data_ptr);
}
git.samba.org / obnox / wireshark / wip.git / blobdiff