Page 1 of 1

naming protocols using PRTO

Posted: Sun Mar 08, 2009 3:11 pm
by LinkLooker
Hi,
I'm trying to create a new decoder and would like to provide a meaningful name that would be displayed under the "Protocol" field, rather than just displaying the ethernet protocol number.
If I enter the protocol number into the "Name Table" OmniPeek would successfully recognize the protocol, however I would like to provide more information such as the type of the frame.
So I would like something like "Protocol - Msg Type" to be displayed.
I have no idea how to do it using the PRTO instruction.
please advise.

I have also noticed that some strings end with a "\" and then there's another string.
For example - RSN Information\RSN:
I wonder what is the meaning of this syntax.

thank you,
LL

RE: naming protocols using PRTO

Posted: Tue Mar 10, 2009 9:50 pm
by Spacepacket
Hi LinkLooker,

To have your protocol name displayed in the protocol field of the decoder view, and the protocol column of the packet list, you will need to extend the pspecs.xml. This file is in c:\program files\wildpackets\omnipeek\1033\pspecs.xml. The reference document for protospecs is at https://mypeek.wildpackets.com/document ... /index.php

The "\" in the string parameter is used to specify a short name. The short name is used when you collapse a layer, and in the decoder column of the packet list. If you do not know what the decoder column is, then wow, you are missing out! ;-)

Thanks for the questions, and keep'em comin'.

-SpacePacket

RE: RE: naming protocols using PRTO

Posted: Thu Apr 23, 2009 12:58 pm
by LinkLooker
The decoder column is definitely a great feature. I wonder is it possible to "lock" decoder column on a specific field (it's very easy to accidentally click on another field and discard the original field you wanted to follow).

Another question, is it possible to add several "decoder columns" or several custom columns for your protocol?
where can I find more information about this feature (I have already read the blog post).

thanks,
LL

RE: RE: RE: naming protocols using PRTO

Posted: Tue Apr 28, 2009 2:25 am
by LinkLooker
and another question regarding the decoder column -
when I collapse a custom layer, and select it, the decoder column will only display the first field of that layer. is it possible to have it display all the fields like it does with predefined layers?

thanks

Re: RE: RE: RE: naming protocols using PRTO

Posted: Wed Jul 01, 2009 12:23 pm
by jimm1909
[quote="LinkLooker"]and another question regarding the decoder column -
when I collapse a custom layer, and select it, the decoder column will only display the first field of that layer. is it possible to have it display all the fields like it does with predefined layers?

thanks[/quote]

I've been wondering this for a while too. anybody know the answer?

thanks in advance,

jim

RE: Re: RE: RE: RE: naming protocols using PRTO

Posted: Tue May 18, 2010 8:48 am
by Spacepacket
When you select a layer in the decode view, the collapsed version of that layer will be displayed in the decode column. The fields of the layer that are displayed are the ones which the author of the decode provided a short label for for.

The caveat is that the short label is a fairly new decoder language feature which was invented after most of the decodes were written. If there are layers that do not display the way you like, let us know so we can make the, look better in the next release.

Of course, you can also change the decodes yourself, and send them back to us.

-Spacepacket