Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: [Wireshark-dev] Custom formatter for 64bit field

From: "David Arnold" <david@xxxxxxxxxxx>
Date: Thu, 11 Mar 2010 17:24:56 -0500
Hi!

I'm writing a dissector for a protocol that uses a 64-bit time field
which is not in the format required for FT_ABSOLUTE_TIME.

So, I declared the hfinfo like

        { &hf_prot_pkthdr_time,
          { "Transmit Time", "prot.time",
            FT_UINT64, BASE_CUSTOM,
            prot_fmt_time, 0x0,
            "Transmission timestamp",
            HFILL }
        }

However, this causes an abort from the assertion in proto.c:4182
(trunk), which checks that hfinfo->strings is NULL (no, because of the
custom formatter), or the type matches a set that doesn't include
FT_UINT64.

This is my first attempt at writing a dissector, so I'm sure I'm missing
something.  Can someone point me in the right direction?

Thanks,




d