Wireshark-dev: Re: [Wireshark-dev] proto_tree_add_item with word(hex) mark
From: Jaap Keuter <[email protected]>
Date: Sun, 25 May 2008 09:33:51 +0200

I'm not sure I follow your description, but these parts I can comment on.

proto_tree_add_item(tree,hf,offset,offset+1,FALSE); is wrong. The 'offset+1' part is a length indicator, not an end indicator as you use it. The correct expression should be proto_tree_add_item(tree,hf,offset,1,FALSE);
The field type FT_STRING is for displaying text strings, not arbitrary data.

You further say 'word' and '4 bits'. A 'word' is usually considered to be a 16 or 32 bit value, while '4 bits' is also called a nibble.
To handle the nibbles you can either proto_tree_add_item() with a headerfield 
containing a bitmap, or use proto_tree_add_bits*().

Vipper82 wrote:
Hi all,
i'm writing a dissector, i use proto_tree_add_item for marking 1 word (hex) in frame stream.But proto_tree_add_item marks only in byte with offset means in byte.(proto_add_item(tree,hf,offset,offset +1,FALSE); by hf_register_info, i use FT_STRING and BASE_NONE to display this word on wireshark. but it was not correct. The question is: how can i mark or cut each word (4 bits) from data stream and display it on wireshark?
Thanks for any answer