Wireshark-dev: Re: [Wireshark-dev] dissection question
From: Brian Oleksa <oleksab@xxxxxxxxxxxxxxxxxxxxxx>
Date: Tue, 16 Feb 2010 15:22:24 -0500
Guy / JaapYes....thanks for the extra set of eyes. The size of the router name is a 2 byte field. I was only treating it as one byte.
That made a big difference. :-)The interface count is the same as the router count. When I highlight interface count...it does give me 04 (which is what I would expect because I know what is in this packet)... but it displays a 0 in the tree.
But it does indeed display the correct interface name.And the interface activity is displaying a 01 in the hex dump...but False is displayed.
Any thoughts..??
Thanks again for the help..!!
Brian
*Updated code snippet*
//Router Ext:
               if (code == 1001) {
                   guint8 routercount;
                   guint8 interfacecount;
                   guint16 sizeofinterfacename;
                   guint16 sizeofroutername;
                   guint i;
                   guint k;
                   //router count
                   routercount = tvb_get_guint8(tvb, offset);
                   proto_tree_add_item(helen_sub_tree, 
hf_helen_routerCount, tvb, offset, 1, FALSE);
                   offset += 1;
                   //Router Data
                   for (i = 0; i < routercount; i++) {
                       nstime_t t;
                       guint64 msecs_since_the_epoch;
                       struct tm *tmp;
                       //Size of router name
                       sizeofroutername = tvb_get_ntohs(tvb, offset);
                       proto_tree_add_item(helen_sub_tree, 
hf_helen_sizeofRouterName, tvb, offset, 2, FALSE);
                       offset += 2;
                       //Router Name
                       proto_tree_add_item(helen_sub_tree, 
hf_helen_routername, tvb, offset, sizeofroutername, FALSE);
                       offset += sizeofroutername;
                       //status
                       proto_tree_add_uint(helen_sub_tree, 
hf_helen_routerstatus, tvb, offset, 1, FALSE);
                       offset += 1;
                       //update time
                       msecs_since_the_epoch = tvb_get_ntoh64(tvb, offset);
                       t.secs = msecs_since_the_epoch / 1000;
                       t.nsecs = (msecs_since_the_epoch % 
1000)*1000000; /* milliseconds to nanoseconds */
                       tmp = gmtime(&t.secs);
                       proto_tree_add_time(helen_sub_tree, 
hf_helen_time, tvb, offset, 8, &t);
                       offset += 8;
                       //cpu % used
                       proto_tree_add_uint(helen_sub_tree, 
hf_helen_cpuusage, tvb, offset, 1, FALSE);
                       offset += 1;
                       *//interface count*
                       interfacecount = tvb_get_guint8(tvb, offset);
                       proto_tree_add_uint(helen_sub_tree, 
hf_helen_interface_count, tvb, offset, 1, FALSE);
                       offset += 1;
                       //Interface Data
                       for (k = 0; k < interfacecount; k++) {
                           //Size of interface name
                           sizeofinterfacename = tvb_get_ntohs(tvb, 
offset);
                           proto_tree_add_item(helen_sub_tree, 
hf_helen_sizeofInterfaceName, tvb, offset, 2, FALSE);
                           offset += 2;
                           //Interface Name
                           proto_tree_add_item(helen_sub_tree, 
hf_helen_interfacename, tvb, offset, sizeofinterfacename, FALSE);
                           offset += sizeofinterfacename;
                           //incoming bytes
                              proto_tree_add_item(helen_sub_tree, 
hf_helen_incomingBytes, tvb, offset, 4, FALSE);
                           offset += 4;
                           //outgoing bytes
                           proto_tree_add_item(helen_sub_tree, 
hf_helen_outgoingBytes, tvb, offset, 4, FALSE);
                           offset += 4;
                           *//interface active*
                           proto_tree_add_uint(helen_sub_tree, 
hf_helen_interfaceActivity, tvb, offset, 1, FALSE);
                           offset += 1;
                       }
                   }
               }
static hf_register_info hf[] = {
       { &hf_helen_routerCount,
           { "Router Count", "helen.routerCount", FT_UINT8, BASE_DEC, 
NULL, 0x0,
               NULL, HFILL}},
       { &hf_helen_routerstatus,
           { "Router Status", "helen.routerStatus", FT_UINT8, BASE_DEC, 
VALS(helen_router_status), 0x0,
               NULL, HFILL}},
       { &*hf_helen_interfaceActivity*,
           { "Interface Activity", "helen.interfaceActivity", FT_UINT8, 
BASE_DEC, VALS(helen_router_interfaceActivity), 0x0,
               NULL, HFILL}},
       { &hf_helen_cpuusage,
           { "CPU usage", "helen.cpuUages", FT_UINT8, BASE_DEC, NULL, 0x0,
               NULL, HFILL}},
       { &*hf_helen_interface_count,*
           { "Interface count", "helen.interfaceCount", FT_UINT8, 
BASE_DEC, NULL, 0x0,
               NULL, HFILL}},
       { &hf_helen_sizeofRouterName,
           { "Size of router name", "helen.sizeofRouterName", 
FT_UINT16, BASE_DEC, NULL, 0x0,
               NULL, HFILL}},
       { &hf_helen_sizeofInterfaceName,
           { "Size of Interface Name", "helen.sizeofInterfaceName", 
FT_UINT16, BASE_DEC, NULL, 0x0,
               NULL, HFILL}},
       { &hf_helen_time,
           { "Time", "helen.time", FT_ABSOLUTE_TIME, BASE_NONE, NULL, 0x0,
               NULL, HFILL}},
       { &hf_helen_routername,
           { "Router Name", "helen.routername", FT_STRING, BASE_NONE, 
NULL, 0x0,
               NULL, HFILL}},
       { &hf_helen_interfacename,
           { "Interface Name", "helen.interfaceName", FT_STRING, 
BASE_NONE, NULL, 0x0,
               NULL, HFILL}},
       { &hf_helen_incomingBytes,
           { "Incoming Bytes", "helen.incomingBytes", FT_FLOAT, 
BASE_DEC, NULL, 0x0,
               NULL, HFILL}},
       { &hf_helen_outgoingBytes,
           { "Outgoing Bytes", "helen.outgoingBytes", FT_FLOAT, 
BASE_DEC, NULL, 0x0,
               NULL, HFILL}},
   };
static const value_string helen_router_status[] = {
   { 0, "Good"},
   { 1, "Stale / Not Read"},
   { 0, NULL}
};
static const value_string *helen_router_**interfaceActivity[]* = {
   { 0, "False"},
   { 1, "True"},
   { 0, NULL}
};
Guy Harris wrote:
On Feb 16, 2010, at 11:18 AM, Brian Oleksa wrote:guint8 sizeofroutername;That should presumably be guint16 sizeofroutername; as, according to https://www.darkcornersoftware.com/confluence/display/open/Minotaur+SA+ROUTER+Plugin+Extension it's a 2-byte field, and...//Size of router name sizeofroutername = tvb_get_guint8(tvb, offset);...that should presumably be tvb_get_ntohs() for the same reason. If you fix that, then I suspect that//Router Name proto_tree_add_item(helen_sub_tree, hf_helen_routername, tvb, offset, sizeofroutername, FALSE); offset += sizeofroutername;will work. ___________________________________________________________________________ Sent via: Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx> Archives: http://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe
- Follow-Ups:
- Re: [Wireshark-dev] dissection question
- From: Guy Harris
 
 
- Re: [Wireshark-dev] dissection question
- References:
- [Wireshark-dev] dissection question
- From: Brian Oleksa
 
- Re: [Wireshark-dev] dissection question
- From: Guy Harris
 
 
- [Wireshark-dev] dissection question
- Prev by Date: Re: [Wireshark-dev] dissection question
- Next by Date: [Wireshark-dev] buildbot failure in Wireshark (development) on OSX-10.5-x86
- Previous by thread: Re: [Wireshark-dev] dissection question
- Next by thread: Re: [Wireshark-dev] dissection question
- Index(es):