ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] proto_add_tree_item versus proto_add_tree_string

From: "Neely Grady-W30566" <grady.neely@xxxxxxxxxxxx>
Date: Mon, 12 Mar 2007 20:46:40 -0400
I built a function called tvb_get_bits8 based on some work someone else has done, and it handles incrementing the tvb offset and grabbing the bits I want, even if the straddle byte boundaries.  However, this only works if I retrieve the value.  Seems like their ought to be a way to do this without retrieving the value and printing it via a proto_add_text or _string.  

Is there a better way to handle this situation?  The goal is consistency.  I don't want some fields integer values and others strings.  This simplifies it for the end-user when they are creating display filters.

I am open to alternate suggestions as I am quite new to Wireshark dev.

-----Original Message-----
From: wireshark-dev-bounces@xxxxxxxxxxxxx [mailto:wireshark-dev-bounces@xxxxxxxxxxxxx] On Behalf Of Guy Harris
Sent: Monday, March 12, 2007 7:40 PM
To: Developer support list for Wireshark
Subject: Re: [Wireshark-dev] proto_add_tree_item versus proto_add_tree_string


On Mar 12, 2007, at 5:11 PM, Neely Grady-W30566 wrote:

> The problem I run into is the bitmask will need to be shifted  
> depending on where in the byte the interesting bits are.  Is there a  
> way to shift the bitmasks in the hf_ struct?

No.  The bitmask for any given hf_ structure is a constant.

However, there can be more than one hf_ structure for a given field  
name, with different bit masks.

BTW, how do you plan to handle a field that straddles a byte  
boundary?  You can't do that with a 1-byte field, even if the field  
has fewer than 8 bits.
_______________________________________________
Wireshark-dev mailing list
Wireshark-dev@xxxxxxxxxxxxx
http://www.wireshark.org/mailman/listinfo/wireshark-dev