Wireshark · Wireshark-dev: Re: [Wireshark-dev] 12 byte number

[Jaap Keuter <jaap.keuter@xxxxxxxxx>]

Hi,

I've run into the same issue a while ago. I've addressed it with FT_BYTES. This 
resulted in a searchable field like so:

    { &hf_twelve_bytes,
      { "TB", "myproto.tb",
        FT_BYTES, BASE_NONE,
        NULL, 0x0,
        NULL, HFILL }},


    proto_tree_add_item(proto_tree, hf_twelve_bytes, tvb, offset, 12, FALSE);

This makes it searchable like so:

    myproto.tb == 00:00:00:00:00:00:00:00:00:00:00:6c

Thanx,
Jaap

Martin Corraine (mcorrain) wrote:
> Hello,
>  
> I'm working on another dissector and ran into a problem. As far as I can 
> see in the readme there is no way to fetch a 12 byte unsigned number. 
> Could I use proto_tree_add_bytes(...). If I do use this, would the value 
> be searchable? (I have no way to test this as of yet due to lack of pcap)
>  
> Thanks,
> martin