Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Query regrading removing header

From: "Martin Mathieson" <martin.r.mathieson@xxxxxxxxxxxxxx>
Date: Thu, 16 Aug 2007 16:27:50 +0100


On 16-Aug-2007 18:47:37 ZE5B, vaibhav.agarwal@xxxxxxxxxxx <vaibhav.agarwal@xxxxxxxxxxx > wrote:

Hi,

If I have frame like for eg:-

45 60 76 87 23 97 00

Now in this frame starting 2 bit is header of one dissector now I want to
pass that frame to other dissector after removing the haeder.
If i change the tvb then header remove in form of bytes not in bits.

Please tell How to pass the frame to other dissector after removing the 2
bits from the frame or how to set the tvb then next dissector only read the
frame after 2 bits.


Thanks & Regards,
Vaibhav
 
 
If you really want a new tvb with just those bits, you'd need to:
- allocate a new buffer to hold the data
- copy in the data, shifted along by 2 bits
- pass your new tvb to the subdissector
 
I'm not checking the spec here, but if you're talking about handing off FP Transport blocks to a new MAC dissector:
- DCH TBs are byte-aligned
- HSDPA frames are always 4 bits into a byte because of padding
- for EDCH the TSN begins always at the 3rd bit (the FP dissector currently already handles this field)
 
i.e. can't the MAC dissector work out which offset to look at if you must pass the tvb with the original byte alignment?
 
Martin