Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Help needed on value translation of dissected bits

From: Jaap Keuter <jaap.keuter@xxxxxxxxx>
Date: Thu, 03 Dec 2009 23:56:52 +0100
Hi,

Almost, but that put bit 8 in Byte 1 at the LSB for Value B, while it's supposed to be the MSB. This is a really weird encoding, not something supported by normal routines. Chris pointed you in the right direction how to present 'interpreted' data.

Thanks,
Jaap

John Tapparo wrote:
Does defining it as
{ &hf_myproto_B,
  { "B Value", "myproto.b",
       FT_UINT16, BASE_DEC, NULL, 0xff80, NULL, HFILL
  }
}

And then using
proto_tree_add_item(tree, hf_myproto_B, tvb, o, 2, TRUE);
do what you want (basically telling it that the value is little_endian)?

On Wednesday 02 December 2009 11:55:55 Jarolin, Robert wrote:
Let me give an example:
Assume that you have 2 bytes to dissect that are formatted as follows:
- There are 2 values, A and B that are encoded into 2 Bytes
- Value A has a maximum size of 127 and is encoded using the lower 7
bits of Byte 1
- Value B has a maximum size of 511 and is encoded using all 8 bits in
Byte 2 along with bit 8 in Byte 1 representing the MSB for Value B

Normally, I would define the dissection in the hf structure as follows:
{ &hf_myproto_B,
  { "B Value", "myproto.b",
       FT_UINT16, BASE_DEC, NULL, 0x80ff, NULL, HFILL
  }
}