Calling proto_register_field_array outside of proto_register_MYPROTOCOL?

asked 2024-09-01 20:39:18 +0000

addy_wireshark2024
1

Hello! So I have written a dissector for a custom protocol and in several instances I have a payload that does will only have a certain number of 32 bit words contain valid data while others will contain a marker like 0xdeadbeef to indicate that they weren't used. This is highly variable. The way I currently understand dissection with C, you must register all header fields and the base/display types within the proto_register_MYPROTOCOL function by calling proto_register_field_array on an array of header fields. This leaves the base and field type rigid, with no ability to change it later. Is there any way to allocate header fields only when I need to depending on whether a payload subdissector is called or not, without having to declare all beforehand?

answered 2024-09-02 00:45:52 +0000

johnthacker
156 ●25 ●4

It is possible to register fields outside of the proto_register_MYPROTOCOL function. For examples for particular reasons, see packet-radius.c and packet-diameter.c, which register the protocol (and a small number of fields) initially, and then register the rest of the fields (which require parsing text files) only when a packet encountering the protocol is parsed, or in a few cases such as wanting to see reports that list all the fields.

However, your custom protocol does not sound like the kind of thing that would need to register fields dynamically. It doesn't sound particularly variable or like there's very many fields. Why would you not register a field for the marker and register fields for the various types you encounter? Can you explain why you think you need to do that?

edit flag offensive delete link

add a comment

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Calling proto_register_field_array outside of proto_register_MYPROTOCOL?

1 Answer

Your Answer

Question Tools

Stats

Calling proto_register_field_array outside of proto_register_MYPROTOCOL? edit

1 Answer

Your Answer

Question Tools

Stats

Calling proto_register_field_array outside of proto_register_MYPROTOCOL?