This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi Forum,

I am trying to write a dissector for a protocol. I cannot figure out how to display a sub tree PLUS box and sub fields.

I have created a simple example of what I have done.

My protocol has UINT16 message length followed FCOD (UNIT8). I want to use this FCODE as a subtree and have a PLUS box and sub fields, but I have been unable to get it to work.

I am expecting to see

+FOO Protocol
    Message Length 1234
    +FCODE
        FLAGS

Thanks

Stuart

#ifdef HAVE_CONFIG_H
#include "config.h"
#endif

#include <epan/packet.h>
#define FOO_PORT 2000

static int hf_header_message_length = -1;
static int hf_header_fcode          = -1;

static int hf_fcode_flag            = -1;

static int ett_fooheader = -1;
static int ett_foosegment = -1;

static int proto_foo = -1;

// define protocol names, register structure
void proto_register_foo(void)
{
    static hf_register_info hf[] = {
        { &hf_header_message_length,
            { "Message Length", "foo.msglength",
            FT_UINT16, BASE_DEC,
            NULL, 0x0,
            NULL, HFILL }
        },
        { &hf_header_fcode,
            { "Function Code", "foo.FCode",
            FT_UINT8, BASE_HEX,
            NULL, 0x0,
            NULL, HFILL }
        },
        { &hf_fcode_flag,
            { "Fcode Flags", "foo.Fcode.flags",
            FT_UINT8, BASE_HEX,
            NULL, 0x0,
            NULL, HFILL }
        }
    };

    static int *ett[] = {
        &ett_fooheader,         //foo header
        &ett_foosegment
    };

    proto_foo = proto_register_protocol (
        "FOO Potocol",      // name
        "FOO",              // short name
        "foo"               // abb ref
        );

    proto_register_field_array(proto_foo, hf, array_length(hf));
    proto_register_subtree_array(ett, array_length(ett));
}

static void dissect_foo(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) {

    int offset = 0;
    guint8 fcode  = 0;

    col_set_str(pinfo->cinfo, COL_PROTOCOL, "FOO");
    // Clear out stuff in the info column
    col_clear(pinfo->cinfo,COL_INFO);

    if (tree) { // in case that someone wants to know some details of our protocol
        proto_item *ti = NULL;
        proto_tree *header_tree = NULL;

        ti = proto_tree_add_item(tree, proto_foo, tvb, 0, -1, ENC_NA);  // Grab all the data from the TCP Layer
        header_tree = proto_item_add_subtree(ti, ett_fooheader);

        proto_tree_add_item(header_tree, hf_header_message_length, tvb, offset, 2,  ENC_BIG_ENDIAN);
        offset +=2;

        fcode = tvb_get_guint8(tvb, offset);

        if (fcode = 0x00) {
            proto_tree *sub_tree = NULL;
            sub_tree = proto_item_add_subtree(header_tree, ett_foosegment);
            proto_tree_add_item(sub_tree, hf_fcode_flag, tvb, offset, 1,  ENC_BIG_ENDIAN);
            offset++;
        }
    }
}

void proto_reg_handoff_foo(void) {
    static dissector_handle_t foo_handle;
    foo_handle = create_dissector_handle(dissect_foo, proto_foo);
    dissector_add_uint("tcp.port", FOO_PORT, foo_handle);
}

asked 04 Dec '12, 01:18

StuieNorris's gravatar image

StuieNorris
6557
accept rate: 0%

edited 04 Dec '12, 13:45

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196

(Presumably that should be if (fcode == 0x00), as if (fcode = 0x00) will set fcode to 0 and return 0 as the result, so the test will always fail. Fun with C....)

(04 Dec '12, 13:48) Guy Harris ♦♦

You need to do something like this:

if (fcode == 0x00) {
        proto_tree *sub_tree = NULL;
        proto_item *sub_item = NULL;
        sub_item = proto_tree_add_item(header_tree, hf_new, ...); /*you need a new field*/
        sub_tree = proto_item_add_subtree(sub_item , ett_foosegment);

        proto_tree_add_item(sub_tree, hf_fcode_flag, tvb, offset, 1,  ENC_BIG_ENDIAN);
        offset++;
    }
permanent link

answered 04 Dec '12, 01:40

SidR's gravatar image

SidR
245121722
accept rate: 30%

edited 04 Dec '12, 20:36

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×637
×20

question asked: 04 Dec '12, 01:18

question was seen: 2,092 times

last updated: 04 Dec '12, 20:36

p​o​w​e​r​e​d by O​S​Q​A