Wireshark-dev: Re: [Wireshark-dev] proto_add_tree_item versus proto_add_tree_string

From: "Neely Grady-W30566" <grady.neely@xxxxxxxxxxxx>
Date: Mon, 12 Mar 2007 20:11:36 -0400

Thanks for the response.

Yes I am using a separate field name for each field.  Right now they are all of type FT_STRING.  

The problem I run into is the bitmask will need to be shifted depending on where in the byte the interesting bits are.  Is there a way to shift the bitmasks in the hf_ struct?

The fields are always the same length its just their position in the bytes that varies.

I would really like the values to be integer values so when the user enters a filter, he doesn't have to know whether the field is a string or integer type.

Hope that helps clear it up some.

-----Original Message-----
From: wireshark-dev-bounces@xxxxxxxxxxxxx [mailto:wireshark-dev-bounces@xxxxxxxxxxxxx] On Behalf Of Stephen Fisher
Sent: Monday, March 12, 2007 6:54 PM
To: Developer support list for Wireshark
Subject: Re: [Wireshark-dev] proto_add_tree_item versus proto_add_tree_string

On Mon, Mar 12, 2007 at 02:07:59PM -0400, Neely Grady-W30566 wrote:

> Hi I am new to the list and this is my first post.

Welcome!

> I am writing a dissector plugin for Wireshark and have a question.  
> If I have a set of data that I am iterating through.  Sometimes the 
> one message inside the data ends on a byte boundary, and others end on 
> the third bit or the fifth bit or some other non-nibble boundary bit.
> 
> What I want to do is print this different fields inside each message. 
> But I cannot assume a bitmask will always be the same since each 
> message can end essentially anywhere in the bytestream and not just on 
> a boundary.
>
> Can I use the proto_tree_add_item? How would I define a bitmask in the 
> hf_ structure?

Are you using the same field name for each message, no matter which bit 
it ends on?  In this case, you wouldn't be able to use 
proto_tree_add_item() unless you defined three different field names, 
each with a different bitmask.  You would still need logic in the 
program to determine which field to use in the proto_tree_add_item() 
call.  How does the protocol specify how long the bit stream will be?


Steve
_______________________________________________
Wireshark-dev mailing list
Wireshark-dev@xxxxxxxxxxxxx
http://www.wireshark.org/mailman/listinfo/wireshark-dev