What type of file are you reading? Are you using your own wiretap
module to read your own file format? if so, there may be a bug in the
data your wiretap module is passing to ethereal, specifically the file
offset.
--gilbert
On Tue, 15 Mar 2005 17:23:29 +0530, harshas <harshas@xxxxxxxxxxxxxxxxxxx> wrote:
> Hello sir,
> I have a problem in display filters. Whenever I apply a display filter
> for the packets say (frame.number >= 12 && frame.number <-=100) I will
> get the filtered packets on the screen but with different packet info.
> The value of the packet info will be different.
>
> 1. I want to know whenever I apply display filters etheeal gets bytes from
> the memory or reads from the captured file.Where does it get the
> packet_info? ie where will be the value of the packet_info stored so that
> ethereal get its value when filtering is applied.
> 2. Please tell me in which part of the code I can check the value of the
> packet_info column when filtering is applied.
>
> Regards
> Harsha
>
> ----- Original Message -----
> From: "Jaap Keuter" <jaap.keuter@xxxxxxxxx>
> To: "Ethereal development" <ethereal-dev@xxxxxxxxxxxx>
> Sent: Friday, March 04, 2005 4:39 PM
> Subject: Re: [Ethereal-dev] Regarding Memory allocation
>
>
> > On Fri, 4 Mar 2005, harshas wrote:
> >
> > > Hello sir,
> > > I want to display the contents of the hex byte in form of protocol
> tree.I
> > > could able to print it in the form of hex and decimal.But I want to
> print
> > > the value of hex byte
> > > getting from the tvbuff in the form of bits.(FF = 1111 1111 ) and so
> on.
> > > Is there ant method to print in the protocol tree the binary values
> of
> > > the hex byte.?If so please tell me which routne to use ?
> > > Regards
> > > harsha
> >
> > >From README.developer
> >
> > bitmask
> > -------
> > If the field is a bitfield, then the bitmask is the mask which will
> > leave only the bits needed to make the field when ANDed with a value.
> > The proto_tree routines will calculate 'bitshift' automatically
> > from 'bitmask', by finding the rightmost set bit in the bitmask.
> > If the field is not a bitfield, then bitmask should be set to 0.
> >
> > >From what I understand in your question you'll need something like
> >
> > { &hf_field,
> > { "Field", "field",
> > FT_UINT8, BASE_DEC, NULL, 0xFF,
> > "Field", HFILL
> > }
> > },
> >
> > Maybe you should read the developer manual more thoroughly. Also take a
> > peak at all the other decoders in the source tree.
> >
> > Good luck,
> > Jaap
> >
> >
> > _______________________________________________
> > Ethereal-dev mailing list
> > Ethereal-dev@xxxxxxxxxxxx
> > http://www.ethereal.com/mailman/listinfo/ethereal-dev
> >
>
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev
>
>
