This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

END OF DATA ITEM:

0

In my dissector, add_item for my protocol data starting @ offset += 17;. The next function code after starts 3 bytes from the end. Example below:

hf_funky_data STARTS @ offset += 17 :START DATA: 38 43 31 39 33 44 30 33 46 30 30 30 30 :STOP DATA:

hf_funky_id always STARTS 3 bytes from the END: :START ID: 39 31 34 :END:

How do I setup my dissector so it stops 3 Bytes short, it always starts at the correct byte but always runs to the last byte in the data packet.

Thoughts?

asked 11 Jan '13, 16:40

jballard1979's gravatar image

jballard1979
207710
accept rate: 0%

edited 11 Jan '13, 16:41