Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] 12 byte number

From: Jaap Keuter <jaap.keuter@xxxxxxxxx>
Date: Wed, 20 Aug 2008 21:18:29 +0200
Hi,

I've run into the same issue a while ago. I've addressed it with FT_BYTES. This resulted in a searchable field like so:

    { &hf_twelve_bytes,
      { "TB", "myproto.tb",
        FT_BYTES, BASE_NONE,
        NULL, 0x0,
        NULL, HFILL }},


    proto_tree_add_item(proto_tree, hf_twelve_bytes, tvb, offset, 12, FALSE);

This makes it searchable like so:

    myproto.tb == 00:00:00:00:00:00:00:00:00:00:00:6c

Thanx,
Jaap

Martin Corraine (mcorrain) wrote:
Hello,
I'm working on another dissector and ran into a problem. As far as I can see in the readme there is no way to fetch a 12 byte unsigned number. Could I use proto_tree_add_bytes(...). If I do use this, would the value be searchable? (I have no way to test this as of yet due to lack of pcap) Thanks,
martin