Wireshark · Wireshark-dev: Re: [Wireshark-dev] dissection question

[Brian Oleksa <oleksab@xxxxxxxxxxxxxxxxxxxxxx>]

Guy / Jaap

Yes....thanks for the extra set of eyes. The size of the router name is 
a 2 byte field. I was only treating it as one byte.

That made a big difference. :-)

The interface count is the same as the router count. When I highlight 
interface count...it does give me 04 (which is what I would expect 
because I know what is in this packet)... but it displays a 0 in the tree.

But it does indeed display the correct interface name.

And the interface activity is displaying a 01 in the hex dump...but 
False is displayed.

Any thoughts..??

Thanks again for the help..!!

Brian

*Updated code snippet*
//Router Ext:
               if (code == 1001) {
                   guint8 routercount;
                   guint8 interfacecount;
                   guint16 sizeofinterfacename;
                   guint16 sizeofroutername;
                   guint i;
                   guint k;

                   //router count
                   routercount = tvb_get_guint8(tvb, offset);
                   proto_tree_add_item(helen_sub_tree, 
hf_helen_routerCount, tvb, offset, 1, FALSE);
                   offset += 1;


                   //Router Data
                   for (i = 0; i < routercount; i++) {
                       nstime_t t;
                       guint64 msecs_since_the_epoch;
                       struct tm *tmp;

                       //Size of router name
                       sizeofroutername = tvb_get_ntohs(tvb, offset);
                       proto_tree_add_item(helen_sub_tree, 
hf_helen_sizeofRouterName, tvb, offset, 2, FALSE);
                       offset += 2;

                       //Router Name
                       proto_tree_add_item(helen_sub_tree, 
hf_helen_routername, tvb, offset, sizeofroutername, FALSE);
                       offset += sizeofroutername;

                       //status
                       proto_tree_add_uint(helen_sub_tree, 
hf_helen_routerstatus, tvb, offset, 1, FALSE);
                       offset += 1;

                       //update time
                       msecs_since_the_epoch = tvb_get_ntoh64(tvb, offset);
                       t.secs = msecs_since_the_epoch / 1000;
                       t.nsecs = (msecs_since_the_epoch % 
1000)*1000000; /* milliseconds to nanoseconds */
                       tmp = gmtime(&t.secs);
                       proto_tree_add_time(helen_sub_tree, 
hf_helen_time, tvb, offset, 8, &t);
                       offset += 8;

                       //cpu % used
                       proto_tree_add_uint(helen_sub_tree, 
hf_helen_cpuusage, tvb, offset, 1, FALSE);
                       offset += 1;

                       *//interface count*
                       interfacecount = tvb_get_guint8(tvb, offset);
                       proto_tree_add_uint(helen_sub_tree, 
hf_helen_interface_count, tvb, offset, 1, FALSE);
                       offset += 1;

                       //Interface Data
                       for (k = 0; k < interfacecount; k++) {

                           //Size of interface name
                           sizeofinterfacename = tvb_get_ntohs(tvb, 
offset);
                           proto_tree_add_item(helen_sub_tree, 
hf_helen_sizeofInterfaceName, tvb, offset, 2, FALSE);
                           offset += 2;

                           //Interface Name
                           proto_tree_add_item(helen_sub_tree, 
hf_helen_interfacename, tvb, offset, sizeofinterfacename, FALSE);
                           offset += sizeofinterfacename;

                           //incoming bytes
                              proto_tree_add_item(helen_sub_tree, 
hf_helen_incomingBytes, tvb, offset, 4, FALSE);
                           offset += 4;

                           //outgoing bytes
                           proto_tree_add_item(helen_sub_tree, 
hf_helen_outgoingBytes, tvb, offset, 4, FALSE);
                           offset += 4;

                           *//interface active*
                           proto_tree_add_uint(helen_sub_tree, 
hf_helen_interfaceActivity, tvb, offset, 1, FALSE);
                           offset += 1;

                       }

                   }

               }



static hf_register_info hf[] = {
       { &hf_helen_routerCount,
           { "Router Count", "helen.routerCount", FT_UINT8, BASE_DEC, 
NULL, 0x0,
               NULL, HFILL}},
       { &hf_helen_routerstatus,
           { "Router Status", "helen.routerStatus", FT_UINT8, BASE_DEC, 
VALS(helen_router_status), 0x0,
               NULL, HFILL}},
       { &*hf_helen_interfaceActivity*,
           { "Interface Activity", "helen.interfaceActivity", FT_UINT8, 
BASE_DEC, VALS(helen_router_interfaceActivity), 0x0,
               NULL, HFILL}},
       { &hf_helen_cpuusage,
           { "CPU usage", "helen.cpuUages", FT_UINT8, BASE_DEC, NULL, 0x0,
               NULL, HFILL}},
       { &*hf_helen_interface_count,*
           { "Interface count", "helen.interfaceCount", FT_UINT8, 
BASE_DEC, NULL, 0x0,
               NULL, HFILL}},
       { &hf_helen_sizeofRouterName,
           { "Size of router name", "helen.sizeofRouterName", 
FT_UINT16, BASE_DEC, NULL, 0x0,
               NULL, HFILL}},
       { &hf_helen_sizeofInterfaceName,
           { "Size of Interface Name", "helen.sizeofInterfaceName", 
FT_UINT16, BASE_DEC, NULL, 0x0,
               NULL, HFILL}},
       { &hf_helen_time,
           { "Time", "helen.time", FT_ABSOLUTE_TIME, BASE_NONE, NULL, 0x0,
               NULL, HFILL}},
       { &hf_helen_routername,
           { "Router Name", "helen.routername", FT_STRING, BASE_NONE, 
NULL, 0x0,
               NULL, HFILL}},
       { &hf_helen_interfacename,
           { "Interface Name", "helen.interfaceName", FT_STRING, 
BASE_NONE, NULL, 0x0,
               NULL, HFILL}},
       { &hf_helen_incomingBytes,
           { "Incoming Bytes", "helen.incomingBytes", FT_FLOAT, 
BASE_DEC, NULL, 0x0,
               NULL, HFILL}},
       { &hf_helen_outgoingBytes,
           { "Outgoing Bytes", "helen.outgoingBytes", FT_FLOAT, 
BASE_DEC, NULL, 0x0,
               NULL, HFILL}},
   };



static const value_string helen_router_status[] = {
   { 0, "Good"},
   { 1, "Stale / Not Read"},
   { 0, NULL}
};

static const value_string *helen_router_**interfaceActivity[]* = {
   { 0, "False"},
   { 1, "True"},
   { 0, NULL}
};







Guy Harris wrote:
> On Feb 16, 2010, at 11:18 AM, Brian Oleksa wrote:
>
>   
> >                    guint8 sizeofroutername;
> >     
>
> That should presumably be
>
>                    guint16 sizeofroutername;
>
> as, according to
>
> 	https://www.darkcornersoftware.com/confluence/display/open/Minotaur+SA+ROUTER+Plugin+Extension
>
> it's a 2-byte field, and...
>
>   
> >                        //Size of router name
> >                        sizeofroutername = tvb_get_guint8(tvb, offset);
> >     
>
> ...that should presumably be tvb_get_ntohs() for the same reason.
>
> If you fix that, then I suspect that
>
>   
> >                        //Router Name
> >                        proto_tree_add_item(helen_sub_tree, hf_helen_routername, tvb, offset, sizeofroutername, FALSE);
> >                        offset += sizeofroutername;
> >     
>
> will work.
> ___________________________________________________________________________
> Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
> Archives:    http://www.wireshark.org/lists/wireshark-dev
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
>              mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe
>