Wireshark-dev: Re: [Wireshark-dev] "Scaled" integer fields in a protocol, can use proto_tree_ad
Hi,
You're looking for proto_tree_add_uint_format_value(tree, id, tvb, start,length,
value, format, ...); It add the field, you format the way the value is presented.
Have a look at doc/README.developer for the details.
Thanx,
Jaap
John Jamulla wrote:
Hi,
In my protocol I have many fields (simple integers) that are scaled. For
the most part in the GUI display I want to print
the "human readable" numbers. So, Say I have a field that represents ft
of altitude, I want to print "XX ft", not the scaled number in the
actual packet.
I need to take the value actually in the packet and multiple it by say
.5 (or any number) to
get the real number of feet of altitude (so that it ranges from .5 ft to
XX ft. in .5 ft steps.)
I know how to get it from a bitmask/bitfield using standard wireshark
functions, but I still need to scale the number
many times.
I don't want to do anything complicated to decode this type of field,
and it seems like it should be easier than what I'm doing.
I just want something like what's normally done, something like this:
proto_tree_add_item(asicp_tree, hf_asicp_mymsg_alt, tvb, offset, 4, TRUE);
BUT - I want some way to have it scale what it gets from the packet
(since it's automatically getting and using the number from the packet
data) by a value/number I supply.
Is there such a function in wireshark? If not is there another way I'm
supposed to be doing this?
Can anyone point me to a good example?
Here's an example of what I've been doing (a little more involved than
above example but same thing):
madd_atten = tvb_get_letohs (tvb, offset);
madd_atten = madd_atten & MADD_ATTEN_MASK_405MSG;
madd_attenReal = madd_atten * 0.25;
g_snprintf(maddAttenString, MAX_STRING_BUFFER,
"Generator (0-%d) [%3d]: MADD ATTEN = %f (0.25 dB lsb)",
GENERATORS_PER_405_MSG-1, i, madd_attenReal);
proto_tree_add_string_format(asicp_tree,
hf_asicp_405_maddattenstring,
tvb, offset, 2, maddAttenString,
"%s", maddAttenString);
Any help is appreciated.
Thanks,
John Jamulla
