Wireshark-dev: Re: [Wireshark-dev] dynamic dissector
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 10 Oct 2006 13:04:56 -0700
John R. wrote:

I was hoping I could just have a few hf table entries for the fixed
portions of the header. But it seems that all of the
proto_tree_add_xxx functions expect a hf id.

Not if "xxx" = "text".

Is it possible to add
entries to the tree control

(Probably best stated as "to the tree" - those functions don't directly affect any GUI widget, they just affect a tree data structure that is used to, among other things, construct the tree widget in the packet detail pane.)

that are not based on an hf entry?

Yes, with proto_tree_add_text().

Would I lose the ability to search for particular values?

If you use proto_tree_add_text(), yes.

If that's not possible to do without losing searchability (i.e. by
simply composing the entire tree control of custom formatted strings)
is it possible to dynamically create new hf entries at runtime?

All hf entries are created at runtime; it's just that almost all of them are created from a static table in the dissector in the register routine.

Constructing that table (the hf[] array) from a file is certainly possible. As far as I know, it'd even be possible to do it in the main dissector routine when you see the first packet, rather than in the register routine.