Wireshark · Wireshark-dev: Re: [Wireshark-dev] TVB Composite packet byte pane problem

[Bill Meier <wmeier@xxxxxxxxxxx>]

On 11/20/2012 3:48 AM, Zadik, Maayan wrote:
> Yes the composite TVB is displayed as single sequence but the
> composite is in fact several TVBs concatenated together, so when I
> click on a field that was generated from the second concatenated TVB,
> it is displays in the byte pane as if it's the base of the sequence
> and not its proper offset. For example: Let's say I have 3 data
> chunks that create the composite: chunk1, chunk2, chunk3, each of
> size 0x0300. So what I see is that the data from chunk2 or chunk3,
> though displayed correctly in the fields pane, is always zero based
> in the byte pane. That is, instead of chunk2 highlighting bytes
> 0x0300 'til 0x0600, it again highlights 0x0000 'til 0x0300 (chunk1's
> area)
>
> Oh, and I'm running Wireshark 1.8.3 32-bit compilation on windows 7,
> if it helps.


OK: now I understand; I'll take a look at this later today or tomorrow 
(if someone doesn't look at it first).

One question: Are you calling 'add_new_data_source()' for the new 
(composite) tvb so as to have a separate byte view pane for the tvb ?

Code snippet from packet-bmc.c

    bit_reversed_tvb = tvb_new_child_real_data(tvb, reversing_buffer, 
len, len);
    add_new_data_source(pinfo, bit_reversed_tvb, "Bit-reversed Data");


Or: is the byte pane you refer to displaying the original, 
non-composite, underlying tvb ?