Wireshark · Wireshark-dev: Re: [Wireshark-dev] Problems in display of RANAP messages

["Anders Broman \(AL/EAB\)" <anders.broman@xxxxxxxxxxxx>]

Hi,

Those are not the routines to use in this case, from tvbuff.h:

 

/** Attach a TVBUFF_REAL_DATA tvbuff to a parent tvbuff. This connection
 * is used during a tvb_free_chain()... the "child" TVBUFF_REAL_DATA acts
 * as if is part of the chain-of-creation of the parent tvbuff, although it
 * isn't. This is useful if you need to take the data from some tvbuff,
 * run some operation on it, like decryption or decompression, and make a new
 * tvbuff from it, yet want the new tvbuff to be part of the chain. The reality
 * is that the new tvbuff *is* part of the "chain of creation", but in a way
 * that these tvbuff routines is ignorant of. Use this function to make
 * the tvbuff routines knowledgable of this fact. */
extern void tvb_set_child_real_data_tvbuff(tvbuff_t* parent, tvbuff_t* child);

 

/**Sets parameters for TVBUFF_REAL_DATA. Can throw ReportedBoundsError. */
extern void tvb_set_real_data(tvbuff_t*, const guint8* data, guint length,
    gint reported_length);

 

/** Combination of tvb_new() and tvb_set_real_data(). Can throw ReportedBoundsError. */
extern tvbuff_t* tvb_new_real_data(const guint8* data, guint length,
    gint reported_length);

 

/** Define the subset of the backing buffer to use.
 *
 * 'backing_offset' can be negative, to indicate bytes from
 * the end of the backing buffer.
 *
 * 'backing_length' can be 0, although the usefulness of the buffer would
 * be rather limited.
 *
 * 'backing_length' of -1 means "to the end of the backing buffer"
 *
 * Will throw BoundsError if 'backing_offset'/'length'
 * is beyond the bounds of the backing tvbuff.
 * Can throw ReportedBoundsError. */
extern void tvb_set_subset(tvbuff_t* tvb, tvbuff_t* backing,
  gint backing_offset, gint backing_length, gint reported_length);

 

/** Combination of tvb_new() and tvb_set_subset()
 * Can throw ReportedBoundsError. */
extern tvbuff_t* tvb_new_subset(tvbuff_t* backing,
  gint backing_offset, gint backing_length, gint reported_length);

Instead you should use:

*nevt_tvb = tvb_new_subset(tvb, offset, length_remaining, len);

Where ofset = Start of ranap message, and both length parameters = length of ranap message.

Then

offset = dissect_ranap_Reset(nevt_tvb , 0, &actx, xxx_tree, hf_xxx_ranap_reset);

Regards

Anders

 

---

From: wireshark-dev-bounces@xxxxxxxxxxxxx [mailto:wireshark-dev-bounces@xxxxxxxxxxxxx] On Behalf Of taraniteja.vishwanatha@xxxxxxxxx
Sent: den 2 maj 2007 10:31
To: wireshark-dev@xxxxxxxxxxxxx
Subject: [Wireshark-dev] Problems in display of RANAP messages

Hi ,

 

I want to include some RANAP ( asn.1 format) messages in my dissector.

I have seen the way H245 messages are included in MEGACO. On similar lines, I have written the following code:

 

dissect_xxx_reset(tvbuff_t *tvb,int offset ,proto_tree *xxx_tree,packet_info *pinfo)

{

guint8 *buf = ep_alloc(10240);

tvbuff_t *ranap_tvb;

int i = 0;

asn1_ctx_t actx;

 

offset = add_IE_indicator(tvb, offset, xxx_tree); /* To add IE Indicator */

offset = add_IE_length(tvb, offset, xxx_tree);    /* To add IE length    */

 

ranap_tvb = tvb_new_real_data(buf,i,i);

tvb_set_child_real_data_tvbuff(tvb,ranap_tvb);

add_new_data_source(pinfo, ranap_tvb, "RANAP OVER XXX");

asn1_ctx_init(&actx, ASN1_ENC_PER, TRUE, pinfo);

offset = dissect_ranap_Reset(tvb, offset, &actx, xxx_tree, hf_xxx_ranap_reset);

 

…………

………

 

}

 

But I am not getting any display of RANAP messages.

 

On the contrary, if I do not use the functions tvb_set_child_real_data_tvbuff,  add_new_data_source, I am getting partial display of the RANAP message.

 

I could not completely understand the way it is implemented inn MEGACO.

1. The purpose of the functions tvb_set_child_real_data_tvbuff and add_new_data_source.

2. The values to be passed to the function tvb_new_real_data. I have initialised with zero, but its not working out.

So can somebody help me on the above mentioned functions and how should I go about implementation.

 

Regards,

Tarani

 

 

The information contained in this electronic message and any attachments to this message are intended for the exclusive use of the addressee(s) and may contain proprietary, confidential or privileged information. If you are not the intended recipient, you should not disseminate, distribute or copy this e-mail. Please notify the sender immediately and destroy all copies of this message and any attachments.

WARNING: Computer viruses can be transmitted via email. The recipient should check this email and any attachments for the presence of viruses. The company accepts no liability for any damage caused by any virus transmitted by this email.

www.wipro.com