I think I'd like to change it to what the attached patch does.
i.e. have a quick look to see if the first few characters are printable.
- if yes, show the string (but as before not formatting more text than will be used)
- if no, just add the details of how many bytes are in the segment
In both cases, I append the details to the ftp-data root itself, rather than make that awkward call to proto_item_add_text(). This saves you opening up the tree (there is now nothing inside it). And you can still make expressions like:
ftp-data contains "PASS"
ftp-data contains 00:01:02
Unless anyone feels strongly about it I'll submit this in a day or 2.
Martin
Attachment:
packet-ftp.c.diff
Description: Binary data