This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How do I dissect a weighted integer type?

0

Suppose, I have a header field that is represented by an arbitrary number of bits (we can assume no more than 32), but in stead of interpreting this as an integer, it is really interpreted as the integer value multiplied by some scalar, resulting in a non-integral value. Since FT_FLOAT and FT_DOUBLE can't have bitmasks, how do I add these to my dissector?

I would just call proto_tree_add_float_bits_value and compute the arguments in the body, but this function isn't part of the API (unusable by a plugin dissector). Do I have to add these as integer types? I don't necessarily need to filter using the computed value (although that would be nice), but I don't want to display the integral value in the dissection tree.

Example: A field, ft_myfloat is 11 bits long, with the bitmask 0x7FF, and another field occupies the remaining bits within its most significant byte. This field uses the scalar 0.101325 to encode its "real" value. So, when it has the value 0x064 (100), the interpreted result should be 10.1325.

So far, I have added them as FT_[U]INT(8|16|24|32) with bitmasks using BASE_CUSTOM, but this is rather cumbersome. I've thought about adding a pair of new ftypes for this since it comes up a lot in the dissectors I write, but so far haven't been able to work out how best to do this.

tl;dr:

What is the best way to add a "weighted integer" type to the dissection?

asked 28 Mar '14, 13:46

multipleinterfaces's gravatar image

multipleinte...
1.3k152340
accept rate: 12%