ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Ethereal-dev: Re: [Ethereal-dev] Regarding Memory allocation

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "harshas" <harshas@xxxxxxxxxxxxxxxxxxx>
Date: Tue, 15 Mar 2005 17:23:29 +0530
Hello sir,
  I have a problem in display filters. Whenever I apply a display filter
  for the packets say (frame.number >= 12 && frame.number <-=100) I will
  get the filtered packets on the screen but with different packet info.
  The value of the packet info will be different.

1. I want to know whenever I apply display filters etheeal gets bytes from
the memory or reads from the captured file.Where does it get the
packet_info? ie where will be the value of the packet_info stored so that
ethereal get its value when filtering is applied.
2. Please tell me in which part of the code I can check the value of the
   packet_info column when filtering is applied.

Regards
     Harsha

----- Original Message -----
From: "Jaap Keuter" <jaap.keuter@xxxxxxxxx>
To: "Ethereal development" <ethereal-dev@xxxxxxxxxxxx>
Sent: Friday, March 04, 2005 4:39 PM
Subject: Re: [Ethereal-dev] Regarding Memory allocation


> On Fri, 4 Mar 2005, harshas wrote:
>
> > Hello sir,
> >   I want to display the contents of the hex byte in form of protocol
tree.I
> > could able to print it in the form of hex  and decimal.But I want to
print
> > the value of hex byte
> >   getting from the tvbuff in the form of bits.(FF = 1111 1111 ) and so
on.
> >     Is there ant method to print in the protocol tree the binary values
of
> > the hex byte.?If so please tell me which routne to use ?
> >     Regards
> >          harsha
>
> >From README.developer
>
>   bitmask
>   -------
>   If the field is a bitfield, then the bitmask is the mask which will
>   leave only the bits needed to make the field when ANDed with a value.
>   The proto_tree routines will calculate 'bitshift' automatically
>   from 'bitmask', by finding the rightmost set bit in the bitmask.
>   If the field is not a bitfield, then bitmask should be set to 0.
>
> >From what I understand in your question you'll need something like
>
>     { &hf_field,
>       { "Field", "field",
>         FT_UINT8, BASE_DEC, NULL, 0xFF,
>         "Field", HFILL
>       }
>     },
>
> Maybe you should read the developer manual more thoroughly. Also take a
> peak at all the other decoders in the source tree.
>
> Good luck,
> Jaap
>
>
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev
>