Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Spam: displaying more than 32 bits

From: "Yosi Saggi" <yosis@xxxxxxxxxxxxxxxxxxxxx>
Date: Sun, 6 Mar 2011 17:14:53 +0200

Disregard that, sorry, must be my crazy computer

 

From: wireshark-dev-bounces@xxxxxxxxxxxxx [mailto:wireshark-dev-bounces@xxxxxxxxxxxxx] On Behalf Of Yosi Saggi
Sent: Sunday, March 06, 2011 5:09 PM
To: Developer support list for Wireshark
Subject: Re: [Wireshark-dev] Spam: displaying more than 32 bits

 

Why is my message subject marked as spam?

 

From: wireshark-dev-bounces@xxxxxxxxxxxxx [mailto:wireshark-dev-bounces@xxxxxxxxxxxxx] On Behalf Of Yosi Saggi
Sent: Sunday, March 06, 2011 4:51 PM
To: Developer support list for Wireshark
Subject: Spam: [Wireshark-dev] displaying more than 32 bits

 

Hi everybody

I have a payload  that its size is 42 bits. I am getting it from the TVB in little Endian.

I have no problem displaying the whole payload as big endian with a guint 64bit variable:

 

guint32  f2_val1, f2_val2;

guint64 f2_val;

 

f2_val1 = tvb_get_letohl(tvb, *plen)

f2_val2 = tvb_get_letohl(tvb, (*plen+4));

f2_val = f2_val1;

f2_val= (f2_val<<32);

f2_val = f2_val|f2_val2;

 

My problem is that each group of bits out of the 42 bits represent something different that I want to display on the wireshark.

I has no problem with less than 32 bits payload using the “proto_tree_add_item” and the correct bitmask, or using “proto_tree_add_bits_ret_val”

 

Are threr any suggestions what can I use to display it correctly. As I have seen that “proto_tree_add_bits_ret_val”, although having a “big endian/little endian” operand, that “little endian” is not implemented yet.

 

Any help/insight would be much appreciated

 

Yosi