Wireshark mailing list archives

Re: What ftypes are "compatible" enough for duplicate fields?


From: Guy Harris <guy () alum mit edu>
Date: Fri, 21 Feb 2014 19:30:19 -0800


On Feb 21, 2014, at 7:22 PM, Evan Huus <eapache () gmail com> wrote:

On Fri, Feb 21, 2014 at 7:13 PM, Hadriel Kaplan
<hadriel.kaplan () oracle com> wrote:

The few such duplicates I checked basically used the FT_NONE field for a tree item; while the "real" ftype field was 
used for actual data. (if I recall correctly)

That's not strictly wrong, just unnecessary. The subtree item can just
be text, as long as the actual data item is still added to be
filterable.

I inferred that he was talking about a dissector that had two entries for "foo.bar", one of which was an FT_NONE used 
for a tree item and one of which was a value for actual data.

I think having a "foo.bar" item under a "foo.bar" item makes no sense; "foo.bar.bletch" and "foo.bar.mumble" as two 
components underneath "foo.bar" makes sense, but not "foo.bar" under "foo.bar".
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe


Current thread: