Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Ethereal-dev: [Ethereal-dev] Adding a new field type.

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Richard Stearn <richard@xxxxxxxxxxxxxxxxxxxxxx>
Date: Sat, 22 Oct 2005 01:26:44 +0100
Greetings to the list

I am attempting to build a dissector for AX.25, one of the Amateur Radio
data protocols, the point I have reached in this is representing an AX.25
address field in the dissection.

Adding a printing format type e.g. AT_AX25 does not present any obvious
difficulties, however it would appear that to be able to present the
address field in a immediately readable form in the protocol tree I need
to add a new field type e.g. FT_AX25. How to do this is not immediately
obvious and I have not (yet) discovered any documentation to guide
me in this. I have followed the implementation of FT_ETHER through and
added functions and entries using "ax25" in place of "ether". Whilst
what I have added does compile without error, at runtime ethereal crashes
with the following error message:

Err  file ftype-bytes.c: line 115 (ax25_fvalue_set): assertion failed: (!already_copied)

so, obviously I have missed something vital.



In epan/ftypes/ftype-bytes.c I have cloned:

ax25_fvalue_set(fvalue_t *fv, gpointer value, gboolean already_copied)
ax25_from_unparsed(fvalue_t *fv, char *s, gboolean allow_partial_value, LogFunc logfunc)
static ftype_t ax25_type = {

from the "ether" versions and added

        ftype_register(FT_AX25, &ax25_type);

In epan/proto.c I have cloned:

proto_tree_add_ax25(proto_tree *tree, int hfindex, tvbuff_t *tvb, gint start, gint length,
proto_tree_set_ax25(field_info *fi, const guint8* value)
proto_tree_set_ax25_tvb(field_info *fi, tvbuff_t *tvb, gint start)

from the "ether" versions.



And in my ax25 dissector I call:

proto_tree_add_ax25( ax25_tree, hf_ax25_dst, tvb, offset, 7, dst_addr );

to add an AX.25 address to the tree.



An AX.25 address field is constructed as follows:

6 bytes of ascii shifted up by one bit and one byte containing the
Secondary Station Identifier (SSID) and some control information.

The SSID & control infor byte format is:

	7 6 5 4 3 2 1 0
	C R R S-S-I-D E

Where:
	C = the control info
	R = a reserved bit (default value = 1)
	SSID = Secondary Station Identifier
	E = the extension bit

The E bit is zero in all except the last bit of the AX.25 address header.
The control bit has no relevance as part of the address.

So for my station G1SOG with an SSID of 7 (commonly written G1SOG-7)
we have the byte sequence:

	8E 62 A6 9E 8E 40 6E



I am currently developing this dissector as a built-in rather than a
plugin as I am dealing with a layer 2 protocol and it is (for me) easier
to follow the way ethernet is handled.

I have missed a vital step somewhere and I hope one of you long time
ethereal devs can assist in indentifying the missed step.

--
Regards
	Richard