Wireshark-dev: Re: [Wireshark-dev] How to extract a string
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Fri, 4 Dec 2009 02:48:50 -0800

On Dec 3, 2009, at 7:57 PM, Rach, Darshan wrote:

I tried doing the following. But I am still not able to find it.

guint16 loc_name_length =0;

/*Location Name Length*/
proto_tree_add_item(oqtp_tree, hf_loc_name_length, tvb, packet_field_offset, 1, FALSE);
loc_name_length = tvb_get_ntohs(tvb, packet_field_offset);

As noted, that's not the length - the two octets before the string are 0x06 and 0x05, neither of which are the length of an 8-ASCII-character/ 9-octet (including the terminating '\0') string.

Also, if the name length is 1 octet, you don't fetch it with tvb_get_ntohs(), as that fetches *two* octets; you fetch it with tvb_get_guint8(). If it's 2 octets, the length in the proto_tree_add_item) call should be 2, and you should do

	packet_field_offset += 2;

after fetching the name length. And the two octets before the string aren't the length, in any case - 0x0605 is a lot more than 8 or 9.

Do you have a spec for this protocol? If so, check it to see what it says about the location name.