This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

offset in packet byte pane

Hello,

I would like to have the packet byte pane show the payload bytes rather ..I.e. i would like the packet bytes pane to ignore the first 14 bytes...What has to be done to modify ??

bytes packet

This question is marked "community wiki".

asked 05 Sep '11, 04:07

flashkicker
109●13●19●19
accept rate: 41%

2 Answers:

From your comment above you'll need to create a new tvb which is the subset of the original tvb using tvb_set_subset() or tvb_new_subset() or tvb_new_subset_remaining() as appropriate and then call add_new_data_source().

This will get you a new tab on the hex bytes pane with your required data.

answered 06 Sep '11, 01:20

grahamb ♦
19.8k●3●30●206
accept rate: 22%

Thanks a lot i will try it out and see

(06 Sep '11, 02:58) flashkicker

The packet bytes pane normally displays the bytes contained in the frame, with the highlighted area being set to the node selected in the packet details tree. The length of the highlight is dictated by the code that added the item to the tree, e.g. in proto_tree_add_item() the start parameter specifies the offset in the tvb that the item starts at, and the length parameter specifies the length of the item. Passing a length of -1 highlights to the end of the packet.

An additional tab containing a subset or a synthesised buffer (e.g. a decrypted buffer) can be added to the packet bytes pane by creating a new tvb and calling add_new_data_source().

answered 05 Sep '11, 04:40

grahamb ♦
19.8k●3●30●206
accept rate: 22%

Thanks for the quick reply ... Yes the packet byte pane shows the bytes in frame is there a way in which we can add an offset of 14 or any other number and make our third pane show only the bytes that we intend to show ....

for example 0000 30 10 11 11 01 11 00 00 00 01 11 00 11 9f 13 14 ASCIISEQ

if i would like the output to start from 9f where can we do that

(05 Sep '11, 23:47) flashkicker

Have you tried modifying main_proto_draw.c in gtk folder? Hope it helps..

(06 Sep '11, 00:17) Terrestrial ...