Wireshark · Wireshark-dev: Re: [Wireshark-dev] proto_tree_add_item with word(hex) mark

[Jaap Keuter <jaap.keuter@xxxxxxxxx>]

Hi,

I'm not sure I follow your description, but these parts I can comment on.

proto_tree_add_item(tree,hf,offset,offset+1,FALSE); is wrong. The 'offset+1' 
part is a length indicator, not an end indicator as you use it. The correct 
expression should be proto_tree_add_item(tree,hf,offset,1,FALSE);

The field type FT_STRING is for displaying text strings, not arbitrary data.

You further say 'word' and '4 bits'. A 'word' is usually considered to be a 16 
or 32 bit value, while '4 bits' is also called a nibble.

To handle the nibbles you can either proto_tree_add_item() with a headerfield 
containing a bitmap, or use proto_tree_add_bits*().

Thanx,
Jaap

Vipper82 wrote:
> Hi all,
> i'm writing a dissector, i use proto_tree_add_item for marking 1 word 
> (hex) in frame stream.But proto_tree_add_item marks only in byte with 
> offset means in byte.(proto_add_item(tree,hf,offset,offset +1,FALSE);
> by hf_register_info, i use FT_STRING and BASE_NONE to display this word 
> on wireshark. but it was not correct.
> The question is: how can i mark or cut each word (4 bits) from data 
> stream and display it on wireshark?
> Thanks for any answer