Wireshark-dev: [Wireshark-dev] Fields registered to non-parent protocol (e.g. ftp and ftp-data)

From: chuck c <bubbasnmp@xxxxxxxxx>
Date: Sun, 13 Jun 2021 18:54:56 -0500
Is it a typo when fields are not registered to the parent protocol or should README.dissector describe if/when this is acceptable?


From README.dissector:
"abbrev (FIELDABBREV)
--------------------
A string with an abbreviation of the field. The abbreviation should start
with the abbreviation of the parent protocol followed by a period as a
separator."

Protocol registration is handled by creating an instance of the
header_field_info struct (or an array of such structs), and
calling the registration function along with the registration ID of
the protocol that is the parent of the fields. 

A few examples:
https://www.wireshark.org/docs/dfref/f/ftp.html
https://www.wireshark.org/docs/dfref/r/rtmac.html
https://www.wireshark.org/docs/dfref/w/wpan.html