This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi,

In one of my protocols I receive an integer which represents an ip address. Like this :

180619876... (which means) = AC40A64 = 10.196.10.1

So I would like to have this integer display the ip address. That is, from 180619876 to 10.196.10.1

Is this possible, is there some easy way?

Thank you in advance,

BR

asked 17 Jan '13, 07:38

harkap's gravatar image

harkap
58811
accept rate: 0%


In one of my protocols I receive an integer

if it's a custom protocol, you need a dissector anyway. Within that code you can do whatever your want, including any number format conversion.

Some information how to develop a dissector.

http://wiki.wireshark.org/Development
http://www.wireshark.org/docs/wsdg_html_chunked/

Regards
Kurt

permanent link

answered 17 Jan '13, 11:03

Kurt%20Knochner's gravatar image

Kurt Knochner ♦
24.8k1039237
accept rate: 15%

edited 17 Jan '13, 11:04

Is that an integer represented as 4 consecutive bytes (i.e., a binary integer), or is it an integer represented as some number of ASCII characters giving a decimal value? If it's just a binary integer, you could treat it in your dissector as being an IPv4 address type rather than an integer type, the same way a lot of other dissectors (such as, well, the IPv4 dissector) do.

permanent link

answered 17 Jan '13, 12:49

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%

Hi,

Guy Harris : I think its a binary integer. What I do is that I paste the value in cals, and click hex. The result is AC40A64. Then I just manually look bytewise to get my ip address ( A means 10 , C4 means 196 etc. ).

Right now the code is

myprotocol.ip = ProtoField.uint8 ("myproto.ip", "ip")

and later down :

subtree:add (myprotocol.ip, buffer(offset, 4))

Kurt : I already have a dissector dissecting my protocol. The question is now how I can make it display ip address format of this field.

Thank you for your help

BR

(17 Jan '13, 23:38) harkap

Spelling error : cals, I mean calc. the windows calculator.

(17 Jan '13, 23:39) harkap

A uint8 field is one byte long; that's not long enough for an IPv4 address.

Even if it were long enough, by virtue of being a uint32 field, that still wouldn't be treated by Wireshark as an IPv4 address.

You want to create a field of type ipv4, i.e.

myprotocol.ip = ProtoField.ipv4("myproto.ip", "ip");

That field will be displayed as an IPv4 address.

(18 Jan '13, 10:24) Guy Harris ♦♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×178
×48
×2

question asked: 17 Jan '13, 07:38

question was seen: 3,597 times

last updated: 18 Jan '13, 10:24

p​o​w​e​r​e​d by O​S​Q​A