This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

[Q] Dissector Sub Items

0

Hi Forum,

I am trying to write a dissector for a protocol. I cannot figure out how to display a sub tree PLUS box and sub fields.

I have created a simple example of what I have done.

My protocol has UINT16 message length followed FCOD (UNIT8). I want to use this FCODE as a subtree and have a PLUS box and sub fields, but I have been unable to get it to work.

I am expecting to see

+FOO Protocol
    Message Length 1234
    +FCODE
        FLAGS

Thanks

Stuart

#ifdef HAVE_CONFIG_H
#include "config.h"
#endif

#include <epan/packet.h> #define FOO_PORT 2000

static int hf_header_message_length = -1; static int hf_header_fcode = -1;

static int hf_fcode_flag = -1;

static int ett_fooheader = -1; static int ett_foosegment = -1;

static int proto_foo = -1;

// define protocol names, register structure void proto_register_foo(void) { static hf_register_info hf[] = { { &hf_header_message_length, { "Message Length", "foo.msglength", FT_UINT16, BASE_DEC, NULL, 0x0, NULL, HFILL } }, { &hf_header_fcode, { "Function Code", "foo.FCode", FT_UINT8, BASE_HEX, NULL, 0x0, NULL, HFILL } }, { &hf_fcode_flag, { "Fcode Flags", "foo.Fcode.flags", FT_UINT8, BASE_HEX, NULL, 0x0, NULL, HFILL } } };

static int *ett[] = {
    &amp;ett_fooheader,         //foo header
    &amp;ett_foosegment
};

proto_foo = proto_register_protocol (
    &quot;FOO Potocol&quot;,      // name
    &quot;FOO&quot;,              // short name
    &quot;foo&quot;               // abb ref
    );

proto_register_field_array(proto_foo, hf, array_length(hf));
proto_register_subtree_array(ett, array_length(ett));

}

static void dissect_foo(tvbuff_t *tvb, packet_info *pinfo, proto_tree *tree) {

int offset = 0;
guint8 fcode  = 0;

col_set_str(pinfo-&gt;cinfo, COL_PROTOCOL, &quot;FOO&quot;);
// Clear out stuff in the info column
col_clear(pinfo-&gt;cinfo,COL_INFO);

if (tree) { // in case that someone wants to know some details of our protocol
    proto_item *ti = NULL;
    proto_tree *header_tree = NULL;

    ti = proto_tree_add_item(tree, proto_foo, tvb, 0, -1, ENC_NA);  // Grab all the data from the TCP Layer
    header_tree = proto_item_add_subtree(ti, ett_fooheader);

    proto_tree_add_item(header_tree, hf_header_message_length, tvb, offset, 2,  ENC_BIG_ENDIAN);
    offset +=2;

    fcode = tvb_get_guint8(tvb, offset);

    if (fcode = 0x00) {
        proto_tree *sub_tree = NULL;
        sub_tree = proto_item_add_subtree(header_tree, ett_foosegment);
        proto_tree_add_item(sub_tree, hf_fcode_flag, tvb, offset, 1,  ENC_BIG_ENDIAN);
        offset++;
    }
}

}

void proto_reg_handoff_foo(void) { static dissector_handle_t foo_handle; foo_handle = create_dissector_handle(dissect_foo, proto_foo); dissector_add_uint("tcp.port", FOO_PORT, foo_handle); }

asked 04 Dec ‘12, 01:18

StuieNorris's gravatar image

StuieNorris
6557
accept rate: 0%

edited 04 Dec ‘12, 13:45

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196

(Presumably that should be if (fcode == 0x00), as if (fcode = 0x00) will set fcode to 0 and return 0 as the result, so the test will always fail. Fun with C….)

(04 Dec ‘12, 13:48) Guy Harris ♦♦


One Answer:

1

You need to do something like this:

if (fcode == 0x00) {
        proto_tree *sub_tree = NULL;
        proto_item *sub_item = NULL;
        sub_item = proto_tree_add_item(header_tree, hf_new, ...); /*you need a new field*/
        sub_tree = proto_item_add_subtree(sub_item , ett_foosegment);
    proto_tree_add_item(sub_tree, hf_fcode_flag, tvb, offset, 1,  ENC_BIG_ENDIAN);
    offset++;
}</code></pre></div><div class="answer-controls post-controls"></div><div class="post-update-info-container"><div class="post-update-info post-update-info-user"><p>answered <strong>04 Dec '12, 01:40</strong></p><img src="https://secure.gravatar.com/avatar/46196bc495ce51058590c4e4ae334d22?s=32&amp;d=identicon&amp;r=g" class="gravatar" width="32" height="32" alt="SidR&#39;s gravatar image" /><p><span>SidR</span><br />

245121722
accept rate: 30%

edited 04 Dec ‘12, 20:36