Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] TVB Composite packet byte pane problem

From: Bill Meier <wmeier@xxxxxxxxxxx>
Date: Tue, 20 Nov 2012 09:06:53 -0500
On 11/20/2012 3:48 AM, Zadik, Maayan wrote:
Yes the composite TVB is displayed as single sequence but the
composite is in fact several TVBs concatenated together, so when I
click on a field that was generated from the second concatenated TVB,
it is displays in the byte pane as if it's the base of the sequence
and not its proper offset. For example: Let's say I have 3 data
chunks that create the composite: chunk1, chunk2, chunk3, each of
size 0x0300. So what I see is that the data from chunk2 or chunk3,
though displayed correctly in the fields pane, is always zero based
in the byte pane. That is, instead of chunk2 highlighting bytes
0x0300 'til 0x0600, it again highlights 0x0000 'til 0x0300 (chunk1's
area)

Oh, and I'm running Wireshark 1.8.3 32-bit compilation on windows 7,
if it helps.



OK: now I understand; I'll take a look at this later today or tomorrow (if someone doesn't look at it first).

One question: Are you calling 'add_new_data_source()' for the new (composite) tvb so as to have a separate byte view pane for the tvb ?

Code snippet from packet-bmc.c

bit_reversed_tvb = tvb_new_child_real_data(tvb, reversing_buffer, len, len);
    add_new_data_source(pinfo, bit_reversed_tvb, "Bit-reversed Data");


Or: is the byte pane you refer to displaying the original, non-composite, underlying tvb ?