Wireshark · Wireshark-dev: [Wireshark-dev] displaying more than 32 bits

["Yosi Saggi" <yosis@xxxxxxxxxxxxxxxxxxxxx>]

Hi everybody

I have a payload  that its size is 42 bits. I am getting it from the TVB in little Endian.

I have no problem displaying the whole payload as big endian with a guint 64bit variable:

 

guint32  f2_val1, f2_val2;

guint64 f2_val;

 

f2_val1 = tvb_get_letohl(tvb, *plen)

f2_val2 = tvb_get_letohl(tvb, (*plen+4));

f2_val = f2_val1;

f2_val= (f2_val<<32);

f2_val = f2_val|f2_val2;

 

My problem is that each group of bits out of the 42 bits represent something different that I want to display on the wireshark.

I has no problem with less than 32 bits payload using the “proto_tree_add_item” and the correct bitmask, or using “proto_tree_add_bits_ret_val”

 

Are threr any suggestions what can I use to display it correctly. As I have seen that “proto_tree_add_bits_ret_val”, although having a “big endian/little endian” operand, that “little endian” is not implemented yet.

 

Any help/insight would be much appreciated

 

Yosi