diff options
Diffstat (limited to 'doc')
| -rw-r--r-- | doc/README.developer | 8 |
1 files changed, 6 insertions, 2 deletions
diff --git a/doc/README.developer b/doc/README.developer index 3032263502..2494325061 100644 --- a/doc/README.developer +++ b/doc/README.developer @@ -964,8 +964,9 @@ FIELDTYPE FT_NONE, FT_BOOLEAN, FT_UINT8, FT_UINT16, FT_UINT24, FT_RELATIVE_TIME, FT_STRING, FT_STRINGZ, FT_UINT_STRING, FT_ETHER, FT_BYTES, FT_IPv4, FT_IPv6, FT_IPXNET, FT_FRAMENUM, FT_PROTOCOL, FT_GUID, FT_OID -FIELDBASE BASE_NONE, BASE_DEC, BASE_HEX, BASE_OCT, BASE_DEC_HEX, BASE_HEX_DEC -FIELDCONVERT VALS(x), TFS(x), NULL +FIELDBASE BASE_NONE, BASE_DEC, BASE_HEX, BASE_OCT, BASE_DEC_HEX, + BASE_HEX_DEC, BASE_RANGE_STRING +FIELDCONVERT VALS(x), RVALS(x), TFS(x), NULL BITMASK Usually 0x0 unless using the TFS(x) field conversion. FIELDDESCR A brief description of the field. PARENT_SUBFIELD Lower level protocol field used for lookup, i.e. "tcp.port" @@ -1596,6 +1597,9 @@ For fields of that type, you would declare an array of "range_string"s: If INTVAL_MIN equals INTVAL_MAX for a given entry the range_string behavior collapses to the one of value_string. +For FT_(U)INT* fields that need a 'range_string' struct, the 'strings' field +would be set to 'RVALS(rvalstringname)'. Furthermore, 'display' field must be +ORed with 'BASE_RANGE_STRING' (e.g. BASE_DEC|BASE_RANGE_STRING). FT_BOOLEANS have a default map of 0 = "False", 1 (or anything else) = "True". Sometimes it is useful to change the labels for boolean values (e.g., |