This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

[closed] Dissector Tree Display Format

0

Hi,

Iam trying for custom dissector bit wise operation octet by octet.my payload may contain max of 255 octets.

while display my tree

i get the value as

    [-] parent tree
        [-] subtree

             ..1. .... = id_present : TRUE (0x01)
             ...0 11.. = length     : TRUE (0x01)

    { &hf_length,
       { "Length Present   ", "Length_present.mine",FT_UINT8, BASE_HEX, VALS(length_vals), 0x40, NULL, HFILL }
    },</code></pre><p>i have 2 questions</p><p>How to Hide</p><pre><code>            ..1. .... =</code></pre><p>and only show</p><pre><code>            id_present : TRUE (0x01)</code></pre><p>I have tried use a value_string but its only taking 0x00 and 0x01. Anything wrong here? Is there any method doing it?</p><p>and next question is instead of</p><pre><code>               VALS(length_vals)</code></pre><p>can i use direct values that can be displayed? anyother method ?? my data is c9 that is 1100 10</p></div><div id="question-tags" class="tags-container tags"><span class="post-tag tag-link-tree" rel="tag" title="see questions tagged &#39;tree&#39;">tree</span> <span class="post-tag tag-link-display" rel="tag" title="see questions tagged &#39;display&#39;">display</span> <span class="post-tag tag-link-format" rel="tag" title="see questions tagged &#39;format&#39;">format</span></div><div id="question-controls" class="post-controls"></div><div class="post-update-info-container"><div class="post-update-info post-update-info-user"><p>asked <strong>03 Jun '14, 02:00</strong></p><img src="https://secure.gravatar.com/avatar/1339589a92af9455063c09e56bfc6299?s=32&amp;d=identicon&amp;r=g" class="gravatar" width="32" height="32" alt="umar&#39;s gravatar image" /><p><span>umar</span><br />

26222427
accept rate: 0%

closed 03 Jun ‘14, 02:11

grahamb's gravatar image

grahamb ♦
19.8k330206

Please don’t raise a new question identical to one you raised earlier. If no-one has responded to your earlier question then it may not be clear what you are asking. Try to add clarifying comments if possible.

(03 Jun ‘14, 02:12) grahamb ♦

The question has been closed for the following reason “Duplicate of http://ask.wireshark.org/questions/33229/dissector-tree-hide-item" by grahamb 03 Jun ‘14, 02:11