Wireshark · Wireshark-dev: Re: [Wireshark-dev] Re-use of header fields

[Benjamin M Stocks <BMStocks@xxxxxxxxxxxxxxx>]

>> I have a question on the mechanics of the header fields in Wireshark. I 
>> am developing a dissector for a protocol where a specific data format 
>> may repeat from 1 -> N times within the same payload. Can I reuse the 
>> same header field identifier, registered with 
>> proto_register_field_array,  for each of the individual data blocks
>> within the same payload?

> Yes.  There is nothing whatsoever that requires that only one instance 
> of a particular registered field appear in a given protocol tree, and 
> there are plenty of dissectors that put multiple instances of a field in 
> a protocol tree if the packet has more than one of them. 

Great! Thanks for the answer, as a follow up question: how does it work when I want to filter on a header field? Will it match ANY of the fields?

Thanks,

Ben

--
Benjamin M. Stocks
Senior Embedded Software Engineer
Rockwell Automation Kinetix Motion
voice: (262)512-7157
email: bmstocks@xxxxxxxxxxxxxxx