Wireshark-dev: Re: [Wireshark-dev] Dissector Question - arrays of data in packets - how to disp
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Stephen Fisher <stephentfisher@xxxxxxxxx>
Date: Tue, 27 Feb 2007 17:05:21 -0800
On Sat, Feb 24, 2007 at 11:04:27AM -0500, John Jamulla wrote:

> I have some data in my own protocol that is really a set of 512, 2 
> byte bit fields, and I want to display something like:
> 
> Generator 1   Fielda
> Generator 1   Fieldb
> Generator 1   Fieldc
> Generator 1   Fieldd
> Generator 2   Fielda
> Generator 2   Fieldb
> Generator 2   Fieldc
> Generator 2   Fieldd
> ...
> 
> Where field a-d are bitfields. I know how to get the bits into a 
> useful value, but I have no idea really how to display something like 
> this?

You would typically use proto_tree_add_item() and define the bitmask as 
part of the hf[] field registration.  Search doc/README.developer for 
bitfield for some more information.  You can also take a look at an 
existing dissector to see how it is handled.  The VNC dissector 
(epan/dissectors/packet-vnc.c) uses bitfields in a number of places, for 
example:

	proto_tree_add_item(subrect_tree, hf_vnc_hextile_subrect_x_pos, tvb, 
				*offset, 1, FALSE);

                { &hf_vnc_hextile_subrect_x_pos,
                  { "X position", "vnc.hextile_subrect_x_pos",
                    FT_UINT8, BASE_DEC, NULL, 0xF0, /* Top 4 bits */
                    "X position of this subrectangle", HFILL }
                },

Does this help?


Steve