Ethereal-dev: [Ethereal-dev] Re: Regarding Memory allocation

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Gilbert Ramirez <gilbertr@xxxxxxxxx>
Date: Tue, 15 Mar 2005 08:04:34 -0500
What type of file are you reading? Are you using your own wiretap
module to read your own file format? if so, there may be a bug in the
data your wiretap module is passing to ethereal, specifically the file
offset.

--gilbert

On Tue, 15 Mar 2005 17:23:29 +0530, harshas <harshas@xxxxxxxxxxxxxxxxxxx> wrote:
> Hello sir,
>   I have a problem in display filters. Whenever I apply a display filter
>   for the packets say (frame.number >= 12 && frame.number <-=100) I will
>   get the filtered packets on the screen but with different packet info.
>   The value of the packet info will be different.
> 
> 1. I want to know whenever I apply display filters etheeal gets bytes from
> the memory or reads from the captured file.Where does it get the
> packet_info? ie where will be the value of the packet_info stored so that
> ethereal get its value when filtering is applied.
> 2. Please tell me in which part of the code I can check the value of the
>    packet_info column when filtering is applied.
> 
> Regards
>      Harsha
> 
> ----- Original Message -----
> From: "Jaap Keuter" <jaap.keuter@xxxxxxxxx>
> To: "Ethereal development" <ethereal-dev@xxxxxxxxxxxx>
> Sent: Friday, March 04, 2005 4:39 PM
> Subject: Re: [Ethereal-dev] Regarding Memory allocation
> 
> 
> > On Fri, 4 Mar 2005, harshas wrote:
> >
> > > Hello sir,
> > >   I want to display the contents of the hex byte in form of protocol
> tree.I
> > > could able to print it in the form of hex  and decimal.But I want to
> print
> > > the value of hex byte
> > >   getting from the tvbuff in the form of bits.(FF = 1111 1111 ) and so
> on.
> > >     Is there ant method to print in the protocol tree the binary values
> of
> > > the hex byte.?If so please tell me which routne to use ?
> > >     Regards
> > >          harsha
> >
> > >From README.developer
> >
> >   bitmask
> >   -------
> >   If the field is a bitfield, then the bitmask is the mask which will
> >   leave only the bits needed to make the field when ANDed with a value.
> >   The proto_tree routines will calculate 'bitshift' automatically
> >   from 'bitmask', by finding the rightmost set bit in the bitmask.
> >   If the field is not a bitfield, then bitmask should be set to 0.
> >
> > >From what I understand in your question you'll need something like
> >
> >     { &hf_field,
> >       { "Field", "field",
> >         FT_UINT8, BASE_DEC, NULL, 0xFF,
> >         "Field", HFILL
> >       }
> >     },
> >
> > Maybe you should read the developer manual more thoroughly. Also take a
> > peak at all the other decoders in the source tree.
> >
> > Good luck,
> > Jaap
> >
> >
> > _______________________________________________
> > Ethereal-dev mailing list
> > Ethereal-dev@xxxxxxxxxxxx
> > http://www.ethereal.com/mailman/listinfo/ethereal-dev
> >
> 
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev
> 
>