Wireshark · Wireshark-dev: Re: [Wireshark-dev] Byte Stream Display in WS

[Guy Harris <guy@xxxxxxxxxxxx>]

On Jun 26, 2009, at 11:46 AM, Jonathan Walker (c) wrote:

>      I was just wondering which structure in the dissect_ ( )  
> function has to do with displaying the bytes (hex and ascii) below  
> the GUI tree?

The only thing a dissector can do is

	1) indicate which *particular* part of the data it was handed  
corresponds to a given field, so that when the field is selected, the  
bytes in question are highlighted;

	2) if it's dissecting data constructed from the raw data (reassembly,  
decryption, decompression, etc.), construct a new tvbuff to hold the  
constructed data, and make it an additional tab in the packet bytes  
pane.