This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Some binary protocols have nullable types, fields that are valid for all values but a single sentinel value which signifies that this field exists on the wire but is unused for this specific packet. A common example would be a single byte quantity field that was not valid if the wire value was 255. Is there any simple, standard built in functionality to display the regular value in cases where it exists and something like No Value (255) in cases where the field contains the sentinel value?

function dissect_example(buffer, offset, packet, parent)
...

  -- Quantity: Unsigned 1 Byte Integer

  local quantitysize = 1

  local quantityrange = buffer(index, quantitysize)

  local element = parent:add(example.fields.quantity, quantityrange)

  if buffer(index - quantitysize, quantitysize):int() == 255 then element:append_text(" [No Value]")

end

This brute force example source prints "Quantity: 255 [No value]" but I am wondering if there is some built in function like the value mask. I tried a value mask of {[255]="No Value"} but this mask prints unknown on regular values. Thoughts?

asked 12 Oct '16, 08:47

william's gravatar image

william
5335
accept rate: 0%

edited 16 Oct '16, 13:35

Lekensteyn's gravatar image

Lekensteyn
2.2k3724


No this is not possible, you have to explicitly check for the value.

When you specify a mask, then you must specify all possible values or else these will show up as Unknown as you have observed. Checking for 255 and then appending the text is indeed the way to go.

permanent link

answered 16 Oct '16, 13:38

Lekensteyn's gravatar image

Lekensteyn
2.2k3724
accept rate: 30%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×431
×63
×6
×1

question asked: 12 Oct '16, 08:47

question was seen: 855 times

last updated: 16 Oct '16, 13:38

p​o​w​e​r​e​d by O​S​Q​A