Wireshark · Wireshark-dev: Re: [Wireshark-dev] newbie question about dissecting protocol with many message subtypes

[Andrew Schweitzer <a.schweitzer.grps@xxxxxxxxx>]

Guy Harris wrote:
> The common practice, however, is to define one array, even with 
> protocols that have one data structure per message.  There is no 
> practical difference between calling proto_register_field_array() once 
> and calling it multiple times, other than the latter being slightly less 
> efficient; the structure of the protocol doesn't dictate the way you 
> register fields.

Ok, I think I got it, thanks. So I guess the hf[] array is just a flat 
repository for information about how to display fields in the gui? I 
suppose we use comments and field names (e.g. 
"field.subfield.subsubfield") to clarify what we are adding?

so hf[] might look like this:
hf[] = {
//Header fields
.... - actual declarations -
//Msg type X fields
.... - actual declarations -
//Msg type X+1 fields
... - actual declarations -

etc...?


> If the first 3-5 fields are common to multiple message types, you'd only 
> register each of those fields once, and use it in all of those message 
> types.

Got it.