how to convert the user-defined item in hr_tree to a human-readable format

Question

I created two items (stamp1 and stamp2 in hr_tree) to label special useful bytes with the following line of code in packet-eth.c:

proto_tree_add_item(fh_tree, vtime_id, trailer_tvb, (trailer_length - 8), 8, FALSE);

Here's the decoding with the items added:

Frame 1: 69 bytes on wire (552 bits), 69 bytes captured (552 bits)
Ethernet II, Src: JuniperN_17:d0:85 (00:05:85:17:d0:85), Dst: Cisco_ef:fd:00 (00:1b:0d:ef:fd:00)
    Destination: Cisco_ef:fd:00 (00:1b:0d:ef:fd:00)
    Source: JuniperN_17:d0:85 (00:05:85:17:d0:85)
    Type: IP (0x0800)
    stamp1: 4e64885133d37df8
    stamp2: 04
    Trailer: 000000000000
Internet Protocol Version 4, Src: 111.72.163.42 (111.72.163.42), Dst: 219.141.191.132 (219.141.191.132)
Transmission Control Protocol, Src Port: 61294 (61294), Dst Port: https (443), Seq: 1, Ack: 1, Len: 0
    Source port: 61294 (61294)
    Destination port: https (443)
    [Stream index: 0]
    Sequence number: 1    (relative sequence number)
    Acknowledgement number: 1    (relative ack number)
    Header length: 20 bytes
    Flags: 0x10 (ACK)
    Window size value: 64860
    [Calculated window size: 64860]
    [Window size scaling factor: -1 (unknown)]
    Checksum: 0x1541 [validation disabled]

But stamp1 is in hex format, which is difficult to understand. I want it in a human-readable format, such as epoch time, instead of the hex string. I've no idea how to do this. Please advise.

Accepted Answer

If I understand you correctly, you can accomplish what you want with something like this:

{ &hf_eth_stamp1,
{ "stamp1", "eth.stamp1", FT_ABSOLUTE_TIME, ABSOLUTE_TIME_UTC, NULL, 0x0, "Ethernet stamp1", HFILL }},

Note the different ftype and display base; these allow you to have the Wireshark back end do most of the heavy lifting. Then, in your proto_dissect_* function:

proto_tree_add_item(fh_tree, stamp1_id, trailer_tvb, (trailer_length - 9), 8, ENC_BIG_ENDIAN | ENC_TIME_TIMESPEC);

Note here that the endianness and time encoding are specified; currently, these will evaluate to 0 (FALSE), but if they change in the future, this scheme will keep your dissector from breaking as it is used internally. Finally, as Jaap mentioned in his answer, you should look into the provided documentation for hints on how to accomplish what you want. I will leave stamp2 to you.

Answer 2

Read up on FT_BYTES and companions in doc/README.developer.