This is a static archive of our old Q&A Site. Please post any new questions and answers at

Dissecting bits instead of bytes


I'm trying to get the first 4 bits and the last 4 bits of a byte.

proto_tree_add_bits_item(tree, hf_capability, tvb, bit_offset, 4, ENC_BIG_ENDIAN);
proto_tree_add_bits_item(tree, hf_capability, tvb, bit_offset+4, 4, ENC_BIG_ENDIAN);
{ &hf_capability,
    { "Capabilities", "status.capability",
    VALS(capabilitynames), 0x0,
},</code></pre><p>When I use this in wireshark, its clearly not happy.</p><pre><code>(lt-wireshark:18421): Pango-WARNING **: Invalid UTF-8 string passed to pango_layout_set_text()</code></pre><p>I think it's because its not a full 8 bits. Do I need to use a bitmask? How do I use a bitmask? I'm stumbling over syntax a lot, so please show me code examples of what I should do.</p><p>Here's where I'm mapping the integers to strings:</p><pre><code>static const value_string capabilitynames[] = {
{ 1, &quot;Switchable&quot; },
{ 2, &quot;Human&quot; },
{ 4, &quot;Mobile&quot; },


asked 31 Jul ‘13, 12:42

Arwen17's gravatar image

accept rate: 0%

One Answer:


One problem is that the value string isn't terminated with { 0, NULL} see if that resolves the problem.

answered 01 Aug '13, 04:25

Anders's gravatar image

Anders ♦
accept rate: 17%

Thank you! That fixed it! I removed the { 0, NULL} a long time ago and it didn't give me any errors or warnings when I did so I assumed it was unnecessary. I only started getting an error when I started trying to work with bits instead of bytes.

(01 Aug '13, 07:19) Arwen17

That would have been easily caught by running tools/ epan/dissectors/packet-foo.c. Incidentally, you've chosen quite a poor name for your display filter of "status.capability". Try running tools/, and also tools/ These handy scripts will help you find many common mistakes.

(05 Aug '13, 07:46) cmaynard ♦♦