This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Getting a value (with tvb_get_XXX) bigger than 64 bits

0

Hi, I want to get a value but i don't know its size till i dissect the previous field. I 'm thinking of using tvb_get_ntoh_64(), but what if value's size is bigger than 64 bits? Also i want to ask how to get a value of an IPv6? i don't want to use tvb_get_ip6 (it is void anyway). Any ideas???

asked 06 Aug '14, 05:02

Miltos%20Patsiouras's gravatar image

Miltos Patsi...
11224
accept rate: 0%

edited 06 Aug '14, 06:13

What type of value do you want to get? Integral? Floating-point? Character string? Raw bytes with no interpretation? Something else?

(06 Aug '14, 21:59) Guy Harris ♦♦

It is an endpoint ID so i assume that it is an integer. Also can you tell me how to get a value of an IPv6? I just need to print the value in a proto_tree_add_text function and i see that for IPv4 tvb_get_ntohl is used as it returns a 32 bit unsigned integer, so what about IPv6?

(07 Aug '14, 02:41) Miltos Patsi...

Whether it's an integer depends on the protocol. What protocol is this?

(07 Aug '14, 03:57) Guy Harris ♦♦

The protocol is rsvp and i'm trying to add a new object(call atributes object) which contains the endpoint ID in a tlv.

(07 Aug '14, 04:03) Miltos Patsi...

3 Answers:

0

If you want a raw buffer containing whatever size you want, you can use tvb_memdup(). But then you will need to know how to interpret its content.

answered 06 Aug '14, 11:07

Pascal%20Quantin's gravatar image

Pascal Quantin
5.5k1060
accept rate: 30%

0

To answer your supplementary question:

Also can you tell me how to get a value of an IPv6? I just need to print the value in a proto_tree_add_text function and i see that for IPv4 tvb_get_ntohl is used as it returns a 32 bit unsigned integer, so what about IPv6?

Generally you should be using proto_tree_add_item() calls rather than getting the data yourself and adding it to the tree with proto_tree_add_text(), this then gives you filterable fields as well. See README.dissector for more info.

If you must get the values for purposes other than displaying in the tree then use tvb_get_ipv4() and tvb_get_ipv6(), again all detailed in README.dissector, read the note concerning ipv4. There are also ip address to string functions, tvb_ip_to_str() and tvb_ip6_to_str(), again all detailed in README.dissector.

answered 07 Aug '14, 03:31

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%

0

So if the TLV containing the endpoint ID is the one described in RFC 6004 section 2.1, the endpoint ID is "defined in [G.8011] and [MEF10.1]".

The second of those references is Metro Ethernet Forum Technical Specification 10.1, which has been superseded by 10.1.1, which has been suspended by 10.2. It also doesn't define anything it calls an "endpoint ID", but it does define an "Ethernet Virtual Connection ID" or "EVC ID" in section 6.2 "EVC ID Service Attribute". That section says

The EVC ID is an arbitrary string administered by the Service Provider that is used to identify an EVC within the MEN. The EVC ID MUST be unique across all EVCs in the MEN. It is intended for management and control purposes. The EVC ID is not carried in any field in the Service Frame. As an example, the AcmethService Provider might use “EVC-0001898-ACME- MEGAMART” to represent the 1898th EVC in the MEN and the customer for the EVC is MegaMart.

so if that's the "endpoint ID", it's an "arbitrary string", not a number. I infer from section 8.3 "Service Attribute Parameters" that "string" would mean "character string".

The first of those references is ITU-T Recommendation G.8011/Y.1307, and doesn't seem to define anything it calls an "endpoint ID". However, section 7.1 "Ethernet virtual connection (EVC)" of that document says:

This clause describes Ethernet virtual connection (EVC) attributes that characterize a particular instance of an Ethernet service. The area of applicability of these EVC attributes is identified in Figure 6-1 as being equivalent to the ETH connection or ETH connectivity (per clause 6.6 of [ITU-T G.8010]). The base set of ITU-T G.8011 EVC attributes is the same as the Ethernet virtual connection (EVC) attributes defined in Table 13 of [MEF 10.2] and they are summarized in Table 7-1.

so it sounds as if an "endpoint ID" might be an "EVC ID", in which case it would be a string, not a number.

And, in fact, RFC 6004 section 2.1 says

Specifically, the Ethernet endpoint identifiers are character based as opposed to the GMPLS norm of being IP address based.

So it's not a number, it's a string, and you'd get it with tvb_get_string_enc(); I don't know what the right encoding would be for the string, but you might want to start with ENC_ASCII. Or, if you just want that value to be displayed in the dissection and be filterable, just add it with proto_tree_add_item(), as per grahamb's reply to your other question.

answered 07 Aug '14, 04:35

Guy%20Harris's gravatar image

Guy Harris ♦♦
17.4k335196
accept rate: 19%