Wireshark · Ethereal-dev: [Ethereal-dev] the same protocol field in multiple dissectors

[NAESSENS Herbert <herbert.naessens@xxxxxxxxxxxxxxx>]

Title: the same protocol field in multiple dissectors

Hi,

Is it possible to register the same protocol field in two dissectors ? The idea is to have a display filter that matches on several protocols at the same time. The protocols are not nested.

e.g.  packet-proto1.c
        { &hf_field_a,
        { "Field A",    "proto1.field_a", FT_UINT8, BASE_HEX, NULL, 0xf0, "Field A" }},
        { &hf_field_b,
        { "Field B",    "proto1.field_b", FT_UINT8, BASE_HEX, NULL, 0xf0, "Field B" }},
        { &hf_field_c,
        { "Field C",    "myproto.field_c", FT_UINT8, BASE_HEX, NULL, 0xf0, "Field C" }}
        packet-proto2.c
        { &hf_field_a,
        { "Field A",    "proto2.field_a", FT_UINT8, BASE_HEX, NULL, 0xf0, "Field A" }},
        { &hf_field_b,
        { "Field B",    "proto2.field_b", FT_UINT8, BASE_HEX, NULL, 0xf0, "Field B" }},
        { &hf_field_c,
        { "Field C",    "myproto.field_c", FT_UINT8, BASE_HEX, NULL, 0xf0, "Field C" }}

The display filter myproto.field == 0 should return packets of both proto1 and proto2.
I've done a test with the example above; the code compiles, ethereal can be started, but the field is only registered with the first protocol.

thanks,
Herbert

 

____

This message and any files transmitted with it are legally privileged and intended for the sole use of the individual(s) or entity to whom they are addressed. If you are not the intended recipient, please notify the sender by reply and delete the message and any attachments from your system. Any unauthorised use or disclosure of the content of this message is strictly prohibited and may be unlawful.

Nothing in this e-mail message amounts to a contractual or legal commitment on the part of EUROCONTROL unless it is confirmed by appropriately signed hard copy.

Any views expressed in this message are those of the sender.