Ask Your Question
0

Custom display field for text-based protocol

asked 2025-10-14 09:34:57 +0000

Unknown user gravatar image

updated 2025-10-14 09:58:02 +0000

I’m writing a dissector for a text-based protocol. There’re fields that identify peers, the fields are N-digit strings (say, 00123, 45678, 00000). Certain peer identifiers have custom meanings, for the rest it is conventional for human-readable stuff to use just the numbers, without leading zeros.

So, I need to make Wireshark display value of such a field in one of two formats:

  • custom strings (for certain values);
  • integers with leading zeros stripped (say, 123 instead of 00123, but 45678 is still 45678).

In fact, I already do such conversion myself (with a custom function) in the dissector to build a COL_INFO string and for proto_item_append_text() which is then used as a root for the rest of fields displayed.

But I can’t seem to understand the right way to declare a header_field_info struct that would let me apply such custom formatting. Right now I managed to display the fields with FT_STRING but then I have all N characters shown, according to the length parameter of proto_tree_add_item.

Reading the source code, seems like custom formatters are not applicable to FT_STRING fields, nor to any other arbitrary-length fields.

What is the recommended way to solve the problem?

edit retag flag offensive close merge delete

1 Answer

Sort by » oldest newest most voted
0

answered 2025-10-14 12:35:30 +0000

johnthacker gravatar image

Assuming thar your numbers fit in an appropriate size integer, I would declare a FT_UINT32 or whatever with the BASE_SPECIAL_VALS property and a value string containing the special values. Then convert your string to an integer manually, and call proto_tree_add_uint

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2025-10-14 09:34:57 +0000

Seen: 133 times

Last updated: Oct 14