ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Ethereal-dev: Re: [ethereal-dev] New dissector question

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Gilbert Ramirez <gram@xxxxxxxxxx>
Date: Tue, 7 Dec 1999 17:24:47 -0600
On Mon, Dec 06, 1999 at 05:10:37PM -0600, Steve Limkemann wrote:
> 
>   The source code and a sample trace file are at
> ftp://wonder.dgtech.com/pub/ethereal/  The computer is connected to the
> net via a single channel ISDN line that should be up 24/7.  I originally
> wrote it for version 0.7.5 but it has been upgraded to work with version
> 0.7.9
> 
>                         Steve

Okay, we'll go ahead and include it in the Etheral source tree.
I would like to change the prefix you used for the protocol, though, since
"g" is rather generic. Do you prefer "gryph" or "gryphon" as
the prefix.

    static hf_register_info hf[] = {
	{ &hf_gryph_src,
	{ "Source",           "g.src", FT_UINT8, BASE_DEC, NULL, 0x0,
	    	"" }},
	{ &hf_gryph_srcchan,
	{ "Source channel",   "g.srcchan", FT_UINT8, BASE_DEC, NULL, 0x0,
	    	"" }},

However...

    data = &pd[offset];
    if (fd)
    	end_of_frame = END_OF_FRAME;
    else {
    	end_of_frame =  ntohs (*(unsigned short *)(data + 4)) + 8;
	end_of_frame += 3 - (end_of_frame + 3) % 4;
    }

We can't just make shorts (or longs) out of arbitrary bytes in the
packet. On RISC machines there are alignment issues... 16-byte integers
need to be aligned on 2-byte boundaries, and 32-byte integers need to
be aligned on 4-byte boundaries. The above code works on ix86, but
not on other CPUs. You never know if the sum total bytes preceding
the gryphon packet is even or odd.  We have some macros in packet.h
to help with these issues: pntohs, pntohl, pletohs, pletohs. You'll
want to convert your uses of ntohs(x) to pntohs(&x).

--gilbert