Wireshark - 0.99.7 Guide de l'utilisateur télécharger pdf (Page 120)

proto_tree_add_item(foo_tree, hf_foo_pdu_type, tvb, offset, 1, FALSE); offset += 1;

proto_tree_add_item(foo_tree, hf_foo_flags, tvb, offset, 1, FALSE); offset += 1;

proto_tree_add_item(foo_tree, hf_foo_sequenceno, tvb, offset, 2, FALSE); offset += 2;

proto_tree_add_item(foo_tree, hf_foo_initialip, tvb, offset, 4, FALSE); offset += 4;

This dissects all the bits of this simple hypothetical protocol. We've introduced a new variable offset

into the mix to help keep track of where we are in the packet dissection. With these extra bits in

place, the whole protocol is now dissected.

9.2.3. Improving the dissection information

We can certainly improve the display of the protocol with a bit of extra data. The first step is to add

some text labels. Let's start by labeling the packet types. There is some useful support for this sort of

thing by adding a couple of extra things. First we add a simple table of type to name.

Example 9.10. Naming the packet types.

static const value_string packettypenames[] = {

{ 1, "Initialise" },

{ 2, "Terminate" },

{ 3, "Data" },

{ 0, NULL }

};

This is a handy data structure that can be used to look up a name for a value. There are routines to

directly access this lookup table, but we don't need to do that, as the support code already has that

added in. We just have to give these details to the appropriate part of the data, using the VALS

macro.

Example 9.11. Adding Names to the protocol.

{ &hf_foo_pdu_type,

{ "FOO PDU Type", "foo.type",

FT_UINT8, BASE_DEC,

VALS(packettypenames), 0x0,

NULL, HFILL }

}

This helps in deciphering the packets, and we can do a similar thing for the flags structure. For this

we need to add some more data to the table though.

Example 9.12. Adding Flags to the protocol.

#define FOO_START_FLAG 0x01

#define FOO_END_FLAG 0x02

#define FOO_PRIORITY_FLAG 0x04

static int hf_foo_startflag = -1;

static int hf_foo_endflag = -1;

static int hf_foo_priorityflag = -1;

...

{ &hf_foo_startflag,

{ "FOO PDU Start Flags", "foo.flags.start",

FT_BOOLEAN, 8,

NULL, FOO_START_FLAG,

NULL, HFILL }

Packet dissection

106

1 2 ... 115 116 117 118 119 120 121 122 123 124 125 ... 146 147

Commentaires sur ces manuels

Pas de commentaire

Wireshark - 0.99.7 Guide de l'utilisateur Page 120

Commentaires sur ces manuels