Two different data views showing the same data. On the left is a complex
gzip view and on the right is a simple ascii view with offset. The selected data
is highlighted blue in both views.
The view can display the data as text or as a combobox with predefined values.
The filename in the gzip view is displayed as text whereas the operation system
is displayed as a combobox.
In the popupmenu you can see several Transformer entries. Transformers modify
the data in a predefined way (e.g. CRC-32 Checksum, Base64 Encode/Decode, Not
etc.). They can be configured by the user.
Here you can see the view definition which is compiled into the gzip view.
The view definition is very flexibly and allows for a wide range of different
view.
The filename of the original file can be encoded or not by gzip and the definition is flexible
enough to model this using a case statement. The case statement in the
example checks the FName Flag. If the flag is set to true the filename field
gets included in the view. If it is set to false it is ommitted.
A very powerful feature is the ability to query views using XPath.
Here is some captured tcp/ip traffic viewed using the libcap.str view definition.
The view was queried using XPath to filter out all ipv4 packets having
a TCP payload.
