Ask Your Question

How do I get and display packet data information at a specific byte from the first byte?

asked 2017-10-31 15:29:15 +0000

mest112 gravatar image

updated 2017-10-31 15:41:42 +0000

grahamb gravatar image

Hello, I am a beginner in Wireshark and dissector building, right now I'm just trying to figure out how to fetch and display packet data. I use the following lines in my dissect function:

guint val;
val = tvb_get_guint8(tvb, 1);
proto_tree_add_uint(masp_tree, hf_masp_data, tvb, 1, 1, val);

Here is an image of the results:

Expected result: 0x00

Actual result: 0x60

Why does fetching the data start from the 43rd byte instead of the very 1st one? How do I resolve this issue?


edit retag flag offensive close merge delete

2 Answers

Sort by ยป oldest newest most voted

answered 2017-11-02 19:28:58 +0000

grahamb gravatar image

updated 2017-11-03 17:59:34 +0000

If your traffic is always over Ethernet you can use the pinfo->dl_dst structure and copy it into a local buffer with address_to_bytes(), e.g.

char myBuff[2];
address_to_bytes(pinfo->dl_dst, myBuff, 2);
char myByte = myBuff[1];
edit flag offensive delete link more

answered 2017-10-31 15:49:49 +0000

grahamb gravatar image

The offset is due to the headers provided by the other parts of the frame, i.e. the Ethernet, IP and UDP headers. Note that by passing the 4th parameter to proto_tree_add_uint() as 1 you're asking for the byte at offset 1 in your tvb, i.e. the second byte in the UDP payload.

Presumably you have registered your dissector with the UDP dissector, hence the preceding items. The byte view shows the whole frame not just your application data.

It's not clear to me why you expect the result to be 0x00, which byte in the byte view are you expecting to read?

edit flag offensive delete link more


Thanks for the answer, I was expecting the second byte (the one beside 01, in the top left corner). I'm aware that passing the 4th parameter as 1 in proto_tree_add_uint() would get me the byte at offset 1 in the tvb, it's just that I was expecting the tvb to start from 01 (the byte at the top left corner of byte view).

The offset is due to the headers provided by the other parts of the frame, i.e. the Ethernet, IP and UDP headers.

Any idea on how I can set this offset to 0?

mest112 gravatar imagemest112 ( 2017-10-31 16:22:57 +0000 )edit

The second byte you are referring to is part of the Ethernet payload, and is not part of the tvb corresponding to the UDP payload (the one that is being given to your dissector). The UDP payload starts at offset 0x2a, so the second byte is 0x60 as seen in your capture.

Why do you want to access the top tvb corresponding to the Ethernet frame?

Pascal Quantin gravatar imagePascal Quantin ( 2017-10-31 16:29:22 +0000 )edit

It's for a project. Is there a way to access the top tvb corresponding to the Ethernet frame?

mest112 gravatar imagemest112 ( 2017-11-01 15:36:12 +0000 )edit

Do you need only the byte or will the Ethernet address do? If the latter, then the packet_info structure passed to your dissector has a member named dl_dst that holds the data link layer destination address.

grahamb gravatar imagegrahamb ( 2017-11-02 11:37:52 +0000 )edit

I need only the byte

mest112 gravatar imagemest112 ( 2017-11-02 14:53:18 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2017-10-31 15:29:15 +0000

Seen: 5,519 times

Last updated: Nov 03 '17