Wireshark · Wireshark-dev: Re: [Wireshark-dev] How to extract a string

["Anders Broman" <a.broman@xxxxxxxxx>]

Hi,

From the picture below it looks like you are reading the length from offset

0x43 the bytes would then be; starting with the high lighted 0x06 which is high lighted by

By proto_add_item with length 1.

06 05 44 72 61 6d 61 65 6e 67 00

Loc_name length would then be 0x0605 as you are reading two octets with tvb_get_ntohs()

Then you are adding the “string”  0x05 44 .. as offset is just moved one byte with a length of

0x0605 with proto_add_item probably causing a “malformed packets” as you are trying to read

outside of the tvb.

 

Best regards

Anders

 

 

---

Från: wireshark-dev-bounces@xxxxxxxxxxxxx [mailto:wireshark-dev-bounces@xxxxxxxxxxxxx] För Rach, Darshan
Skickat: den 4 december 2009 04:58
Till: wireshark-dev@xxxxxxxxxxxxx
Ämne: [Wireshark-dev] How to extract a string

 

Hi,

 

How to extract a string from packet (of Hex values)?

I know the string length.

 

 

I tried doing the following. But I am still not able to find it.

 

guint16 loc_name_length =0;

 

/*Location Name Length*/

proto_tree_add_item(oqtp_tree, hf_loc_name_length, tvb, packet_field_offset, 1, FALSE);

loc_name_length = tvb_get_ntohs(tvb, packet_field_offset);

packet_field_offset += 1;

 

/*Location Name*/

proto_tree_add_item(oqtp_tree, hf_loc_name, tvb, packet_field_offset,loc_name_length ,FALSE);

packet_field_offset = packet_field_offset + loc_name_length + 1;

 

Any help on this would be appreciated.

 

Regards,

Darshan

 

---

This message is confidential and intended only for the addressee. If you have received this message in error, please immediately notify the postmaster@xxxxxxx and delete it from your system as well as any copies. The content of e-mails as well as traffic data may be monitored by NDS for employment and security purposes.
To protect the environment please do not print this e-mail unless necessary.

An NDS Group Limited company. www.nds.com