This is our old Q&A Site. Please post any new questions and answers at

I am working on a protocol dissector where some fields are comprised of fewer than 8 bits. For example, the first 4 bits identify the packet type, and the next 16 bits the length of following data. Can I dissect fields with length less than one byte, and how can I display them?

asked 13 Feb '12, 09:52

ashish_goel's gravatar image

accept rate: 0%

edited 13 Feb '12, 10:48

multipleinterfaces's gravatar image


Absolutely. You can do this by specifying a nonzero bitmask when defining your header fields like so:

{ &hf_packet_type,
{ "type", "myproto.type", FT_UINT8, BASE_DEC, NULL, 0xF0, "Packet Type", HFILL }},
{ &hf_packet_length,
{ "length", "myproto.length", FT_UINT24, BASE_DEC, NULL, 0x0FFFF0, "Packet Length", HFILL }},

Then, simply add them to the tree as you have done for your other protocol fields:

proto_tree_add_item(my_tree, hf_packet_type, tvb, 0, 1, FALSE);
proto_tree_add_item(my_tree, hf_packet_length, tvb, 0, 3, FALSE);

Doing it this way keeps most of the bit-twiddling out of your dissector code, but still allows you to add fields of arbitrary widths and continuities to your protocol.

Note that if you need to work with those bits directly you must extract them from the tvb yourself, just as you do for fields that are byte-bounded and sized in byte-increments, just using one of the tvb_get_bits* functions in stead of one of the other tvb_get* functions.

permanent link

answered 13 Feb '12, 10:46

multipleinterfaces's gravatar image

accept rate: 12%

edited 13 Feb '12, 10:50

See README.developer for proto_tree_add_bits_item() and tvb_get_bits...

(13 Feb '12, 14:20) Anders ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 13 Feb '12, 09:52

question was seen: 3,012 times

last updated: 13 Feb '12, 14:20

p​o​w​e​r​e​d by O​S​Q​A