ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] Get 3 bytes

From: "Steven Le" <programminglist@xxxxxxxxx>
Date: Mon, 12 Mar 2007 16:47:13 -0800
>No bitmasking necessary - FT_UINT24 takes care of it for you.  Just put
0x0 for the bitmask field.

I don't understand this part. Why is bitmask set to 0x instead of doing actually bitmasking
while registering headers?
I have 3 fields in bits that add up total 24 bits
Example : a = 7 bits, b = 14 bits and c= 3 bits. If I don't do bitmask in header files.
How can Wireshark decide which fields being display?
I did like like below

&a....FT_UINT24.......,0xE00000
&b....FT_UINT24.......0x...
&c...

uint32 3BYTES = tvb_get_leoh(tvb, 3);
protocol_add_item(..........,a, offset, 3, TRUE);
protocol_add_item(..........,a, offset, 3, TRUE);
protocol_add_item(..........,a, offset, 3, TRUE); offset +=3;

Is it correct?


On 3/12/07, Guy Harris < guy@xxxxxxxxxxxx> wrote:

On Mar 12, 2007, at 4:32 PM, Steven Le wrote:

> guint32 is 32 bits --> so type mismatch???

No, no type mismatch.  I know of no C implementations on modern
machines that support a 24-bit integral data type, so there's no
"guint24" type.  A 24-bit value fits in 32 bits, so guint32 works fine
for the routines to get 24-bit values.

However, as Stephen Fisher noted, unless you actually need to look at
the value, just use proto_tree_add_item().
_______________________________________________
Wireshark-dev mailing list
Wireshark-dev@xxxxxxxxxxxxx
http://www.wireshark.org/mailman/listinfo/wireshark-dev