Custom Dissector help!

Question

I've got an interesting problem.

I need to create a dissector for a custom protocol, The protocol is very simple and is designed to work on a point to point link as follows.

1 DWORD (32 bits) of Header, the lowest 16 bits of which are a sequence number. Multiples of 8DWORDS which represent Data samples.

I've got the header dissection working, but I can't work out a neat way of chunking up the Data into samples (32 byte chunks following the header).

I've already read the README.developer but couldn't see anything that looks like what I want to do. If anyone could point towards some documentation or an example protocol that would be great.

Thanks in advance!

Accepted Answer

Use say a DWORD is 32-bits (4 bytes) and that there are multiple of 8 DWORDS following the header, so 8 * 4 = 32 bytes, but then you say you want to chunk the data samples into 64 byte chunks? I'll assume somewhere there's a typo and just pick 32 bytes for the chunk size. If it's 64 byte chunks you want, then it's trivial to change.

So, given:

    0                   1                   2                   3
    0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |          Sequence Number      |          Unknown              |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                                                               |
   +                                                               +
   |                                                               |
   +                                                               +
   |                                                               |
   +                                                               +
   |                                                               |
   +                          Data Chunk 1                         +
   |                                                               |
   +                                                               +
   |                                                               |
   +                                                               +
   |                                                               |
   +                                                               +
   |                                                               |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                                                               |
   /                                                               /
   /                                                               /
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+
   |                                                               |
   +                                                               +
   |                                                               |
   +                                                               +
   |                                                               |
   +                                                               +
   |                                                               |
   +                          Data Chunk N                         +
   |                                                               |
   +                                                               +
   |                                                               |
   +                                                               +
   |                                                               |
   +                                                               +
   |                                                               |
   +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+

If the field I've marked above as Unknown is some sort of a length field that you can use to determine the number of chunks, or perhaps a count of the number of chunks, then use that to loop; otherwise, you might use something like the following (Warning: completely untested):

#define CHUNK_SIZE    32
for (i = 1; tvb_reported_length_remaining(tvb, offset) >= CHUNK_SIZE); offset += CHUNK_SIZE, i++) {
proto_tree_add_bytes_format(tree, hf_yourproto_data, tvb, offset, CHUNK_SIZE, NULL,
"Data Chunk %u: %s", i, tvb_bytes_to_str(tvb, offset, CHUNK_SIZE));
/* Or use tvb_bytes_to_str_punct() ... see epan/tvbuff.h for details */

}