This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

How can I dissect fields less than 1-byte wide?

0

I am working on a protocol dissector where some fields are comprised of fewer than 8 bits. For example, the first 4 bits identify the packet type, and the next 16 bits the length of following data. Can I dissect fields with length less than one byte, and how can I display them?

asked 13 Feb '12, 09:52

ashish_goel's gravatar image

ashish_goel
15121216
accept rate: 0%

edited 13 Feb '12, 10:48

multipleinterfaces's gravatar image

multipleinte...
1.3k152340


One Answer:

4

Absolutely. You can do this by specifying a nonzero bitmask when defining your header fields like so:

{ &hf_packet_type,
{ "type", "myproto.type", FT_UINT8, BASE_DEC, NULL, 0xF0, "Packet Type", HFILL }},
{ &hf_packet_length,
{ "length", "myproto.length", FT_UINT24, BASE_DEC, NULL, 0x0FFFF0, "Packet Length", HFILL }},

Then, simply add them to the tree as you have done for your other protocol fields:

proto_tree_add_item(my_tree, hf_packet_type, tvb, 0, 1, FALSE);
proto_tree_add_item(my_tree, hf_packet_length, tvb, 0, 3, FALSE);

Doing it this way keeps most of the bit-twiddling out of your dissector code, but still allows you to add fields of arbitrary widths and continuities to your protocol.

Note that if you need to work with those bits directly you must extract them from the tvb yourself, just as you do for fields that are byte-bounded and sized in byte-increments, just using one of the tvb_get_bits* functions in stead of one of the other tvb_get* functions.

answered 13 Feb '12, 10:46

multipleinterfaces's gravatar image

multipleinte...
1.3k152340
accept rate: 12%

edited 13 Feb '12, 10:50

See README.developer for proto_tree_add_bits_item() and tvb_get_bits...

(13 Feb '12, 14:20) Anders ♦