Wireshark · Ethereal-dev: Re: [Ethereal-dev] A dynamic number of subtrees

[Guy Harris <gharris@xxxxxxxxx>]

Stefano Pettini wrote:

> Very interesting. When can I use the same ett and when should I use a 
> different one?

The intent is that each *type* of subtree have a different ett value. 
For example, if you have a protocol that has a fixed-length header, 
which isn't dissected into a subtree, and a list of TLVs, each type 
value might have a separate ett value, so that, for example, an "IP 
address" TLV would have a separate ett value from a "host name" TLV. 
That way, if you open up the subtree for IP addresses, if you select a 
different packet, the IP addresses subtree will be opened up.

This *does* mean that if you have two IP address TLVs in a packet, and 
you open one of them up but not the other, and you then select a 
different packet and then go back to the first packet, *both* IP address 
TLVs will be opened up.

However, in a system where each subtree, rather than each *type* of 
subtree, had its own ett value, if the first packet had three TLVs and 
you opened the one in the middle, and the second packet had two TLVs, 
should the second TLV be opened?  There isn't any guarantee that the 
second TLV is the one you'd want opened - there's not necessarily any 
semantic significance to the fact that you opened the second one, so 
there's not necessarily any indication that the second TLV is the one 
you always want opened (maybe you want the next-to-the-last TLV opened), 
so it's not clear that'd be the right thing to do.