This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I am working on a protocol dissector where some fields are comprised of fewer than 8 bits. For example, the first 4 bits identify the packet type, and the next 16 bits the length of following data. Can I dissect fields with length less than one byte, and how can I display them?

asked 13 Feb '12, 09:52

ashish_goel's gravatar image

ashish_goel
15121216
accept rate: 0%

edited 13 Feb '12, 10:48

multipleinterfaces's gravatar image

multipleinte...
1.3k152340


Absolutely. You can do this by specifying a nonzero bitmask when defining your header fields like so:

{ &hf_packet_type,
{ "type", "myproto.type", FT_UINT8, BASE_DEC, NULL, 0xF0, "Packet Type", HFILL }},
{ &hf_packet_length,
{ "length", "myproto.length", FT_UINT24, BASE_DEC, NULL, 0x0FFFF0, "Packet Length", HFILL }},

Then, simply add them to the tree as you have done for your other protocol fields:

proto_tree_add_item(my_tree, hf_packet_type, tvb, 0, 1, FALSE);
proto_tree_add_item(my_tree, hf_packet_length, tvb, 0, 3, FALSE);

Doing it this way keeps most of the bit-twiddling out of your dissector code, but still allows you to add fields of arbitrary widths and continuities to your protocol.

Note that if you need to work with those bits directly you must extract them from the tvb yourself, just as you do for fields that are byte-bounded and sized in byte-increments, just using one of the tvb_get_bits* functions in stead of one of the other tvb_get* functions.

permanent link

answered 13 Feb '12, 10:46

multipleinterfaces's gravatar image

multipleinte...
1.3k152340
accept rate: 12%

edited 13 Feb '12, 10:50

See README.developer for proto_tree_add_bits_item() and tvb_get_bits...

(13 Feb '12, 14:20) Anders ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×637
×158
×33

question asked: 13 Feb '12, 09:52

question was seen: 2,950 times

last updated: 13 Feb '12, 14:20

p​o​w​e​r​e​d by O​S​Q​A