Wireshark · Wireshark-dev: Re: [Wireshark-dev] Extract bytes from a tvbuff_t

[Jakub Zawadzki <darkjames-ws@xxxxxxxxxxxx>]

Hi,

On Sun, May 26, 2013 at 09:29:54AM -0600, rion@xxxxxxxxxx wrote:
> I found that this gives me the exact number of bytes I'm looking for:
> 
> fwrite(tvb, tvb_length(tvb), 1, fp);
> 
> Unfortunately, when I check the resulting file in a hex editor the 
> bytes don't match up with what I see in the WireShark UI.
> 
> In the UI I see (Partial):
> 
> 16 03 01 00 39 02 00 00 35 03 01 51 a2 28 a1 19 75 ae ac 53 4f 36 a8 81 
> 62 48
> 
> In the File I see (Partial):
> 
> f0 a5 05 05 d0 6b fa 04 01 00 00 00 01 00 00 00 00 00 00 00 70 6e fa 04 
> d0 6b
> 
> I checked the end of the file to see if the bytes were 'backwards' and 
> they are not. I'm not quite sure what to do now- am I missing something 
> obvious?

Try:
  int tvb_len = tvb_length(tvb);

  fwrite(tvb_get_ptr(tvb, 0, tvb_len), tvb_len, 1, fp);

hth.

Kuba.