Wireshark · Wireshark-dev: Re: [Wireshark-dev] proto_add_tree_item versus proto_add_tree_string

[Stephen Fisher <stephentfisher@xxxxxxxxx>]

On Mon, Mar 12, 2007 at 02:07:59PM -0400, Neely Grady-W30566 wrote:

> Hi I am new to the list and this is my first post.

Welcome!

> I am writing a dissector plugin for Wireshark and have a question.  
> If I have a set of data that I am iterating through.  Sometimes the 
> one message inside the data ends on a byte boundary, and others end on 
> the third bit or the fifth bit or some other non-nibble boundary bit.
> 
> What I want to do is print this different fields inside each message. 
> But I cannot assume a bitmask will always be the same since each 
> message can end essentially anywhere in the bytestream and not just on 
> a boundary.
>
> Can I use the proto_tree_add_item? How would I define a bitmask in the 
> hf_ structure?

Are you using the same field name for each message, no matter which bit 
it ends on?  In this case, you wouldn't be able to use 
proto_tree_add_item() unless you defined three different field names, 
each with a different bitmask.  You would still need logic in the 
program to determine which field to use in the proto_tree_add_item() 
call.  How does the protocol specify how long the bit stream will be?


Steve