Ask Your Question
0

Custom display field for text-based protocol

asked 2025-10-14 09:34:57 +0000

Unknown user gravatar image

updated 2025-10-14 09:58:02 +0000

I’m writing a dissector for a text-based protocol. There’re fields that identify peers, the fields are N-digit strings (say, 00123, 45678, 00000). Certain peer identifiers have custom meanings, for the rest it is conventional for human-readable stuff to use just the numbers, without leading zeros.

So, I need to make Wireshark display value of such a field in one of two formats:

  • custom strings (for certain values);
  • integers with leading zeros stripped (say, 123 instead of 00123, but 45678 is still 45678).

In fact, I already do such conversion myself (with a custom function) in the dissector to build a COL_INFO string and for proto_item_append_text() which is then used as a root for the rest of fields displayed.

But I can’t seem to understand the right way to declare a header_field_info struct that would let me apply such custom formatting. Right now I managed to display the fields with FT_STRING but then I have all N characters shown, according to the length parameter of proto_tree_add_item.

Reading the source code, seems like custom formatters are not applicable to FT_STRING fields, nor to any other arbitrary-length fields.

What is the recommended way to solve the problem?

edit retag flag offensive close merge delete

2 Answers

Sort by » oldest newest most voted
0

answered 2025-10-14 12:35:30 +0000

johnthacker gravatar image

Assuming thar your numbers fit in an appropriate size integer, I would declare a FT_UINT32 or whatever with the BASE_SPECIAL_VALS property and a value string containing the special values. Then convert your string to an integer manually, and call proto_tree_add_uint

edit flag offensive delete link more
0

answered 2025-10-14 10:33:09 +0000

SYN-bit gravatar image

As a field has a type, mixing string type and integer type in the same field is not possible (AFAIK). Would it be an idea to add two fields. One with the string representation (ie custom string or the string representation of the 5 digit number). And one with the integer value (non-translated for the special cases).

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2025-10-14 09:34:57 +0000

Seen: 15 times

Last updated: 4 hours ago