Ask Your Question
0

how to define hf_register_info in dissector

asked 2020-11-05 02:42:47 +0000

taotiemuren gravatar image

updated 2020-11-05 09:07:01 +0000

grahamb gravatar image

I get data in tvbuff_t *tvb, its size is 10 to 50 bit depend on another parameter assume p.
Message structure is as below:

Struct AA  
{    
      Var a : x bit, [0<=range(x)<=32]   
      Var b : y bit, [0<=range(y)<=16]  
};

define static hf_register_info hf[] in dissector, and register it to proto as

proto_register_field_array(proto_xxx, hf, array_length(hf));

Should I define 32+16=48 hf_xxx with different bit_mask and byte_type and select different two hf_xxx for a and b according to p?
Is there any good method to solve this problem?

edit retag flag offensive close merge delete

Comments

So by x bit, [0<=range(x)<=32] do you mean that the first field in the structure is a variable number of bits, with different instances of the structure possibly having different numbers of bits in that field, with the field being somewhere between 0 bits (i.e., absent) and 32 bits?

Guy Harris gravatar imageGuy Harris ( 2020-11-05 03:26:21 +0000 )edit

yes, and y is in the same situation.

taotiemuren gravatar imagetaotiemuren ( 2020-11-05 04:49:56 +0000 )edit

1 Answer

Sort by ยป oldest newest most voted
0

answered 2020-11-05 08:23:59 +0000

Anders gravatar image

Hi, If the var are used to store integers of various sizes add 2 hfs 16 and 32 bits then use proto_tree_add_bits_item() to read the variables from the tvb using the proper bit length.

edit flag offensive delete link more

Comments

It seems to me the complication is that the starting offset for field b ranges from 0 to 32, so you would need a 48 bit integer hf for b, and set the offset and length accordingly in the call to proto_tree_add_bits_item().

grahamb gravatar imagegrahamb ( 2020-11-05 09:13:42 +0000 )edit

Thanks for your advice. I define two hf and adjust bit_mask in each message according to parameter p

taotiemuren gravatar imagetaotiemuren ( 2020-11-17 07:03:06 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2020-11-05 02:42:47 +0000

Seen: 262 times

Last updated: Nov 05 '20