[Andreas <AndreasSander1@xxxxxxx>]

Am 28.12.2010 20:35, schrieb Ed Beroset:
> Andreas wrote:
> > > > So far I've seen only lots of boolean values.
> > >
> > > You might want to take a look at proto_tree_add_bitmask().  See
> > > doc/README.developer, which describes it and illustrates its use by taking an
> > > example from the SCSI dissector.
> >
> > Where can I get a sample capture file to see how this will look like?
>
> The easiest thing might be to look at epan/dissectors/packet-tcp.c for the code and pretty much any capture file with TCP.  In the code, look for hf_tcp_flags and in a capture file, just look at the TCP flags.  Also, looking at doc/README.developer is highly recommended.  It's how I learned.

I did so before asking:

$ grep -l "proto_tree_add_bitmask" *.c
packet-dcerpc-netlogon.c
packet-dlm3.c
packet-fcels.c
packet-fip.c
packet-giop.c
packet-h264.c
packet-ipmi-app.c
packet-ipmi-chassis.c
packet-ipmi-picmg.c
packet-ipmi-se.c
packet-ipmi-storage.c
packet-ipmi-transport.c
packet-maccontrol.c
packet-mrp-msrp.c
packet-nfs.c
packet-omron-fins.c
packet-pnrp.c
packet-sasp.c
packet-scsi-sbc.c
packet-scsi-smc.c
packet-scsi-ssc.c
packet-scsi.c
packet-smb.c
packet-smb2.c
packet-sv.c
packet-tn3270.c
packet-tn5250.c

Andy@HOME ~/Projects/Wireshark/Source/wireshark-1.4.1/epan/dissectors
$

Looks like TCP does _not_ use this function. That's why I asked for a 
sample capture file of one of the protocols above.

This is the actual packet-tcp.c code:

  tf = proto_tree_add_uint_format(tcp_tree, hf_tcp_flags, tvb,
           offset + 13, 1, tcph->th_flags,
           "Flags: 0x%02x (%s)", tcph->th_flags, flags_strbuf->str);
  field_tree = proto_item_add_subtree(tf, ett_tcp_flags);
  proto_tree_add_boolean(field_tree, hf_tcp_flags_cwr, tvb,
                         offset + 13, 1, tcph->th_flags);
  proto_tree_add_boolean(field_tree, hf_tcp_flags_ecn, tvb,
                         offset + 13, 1, tcph->th_flags);
  proto_tree_add_boolean(field_tree, hf_tcp_flags_urg, tvb,
                         offset + 13, 1, tcph->th_flags);
  proto_tree_add_boolean(field_tree, hf_tcp_flags_ack, tvb,
                         offset + 13, 1, tcph->th_flags);
  proto_tree_add_boolean(field_tree, hf_tcp_flags_push, tvb,
                         offset + 13, 1, tcph->th_flags);

> The easiest thing might be to look at epan/dissectors/packet-tcp.c
> for the code and pretty much any capture file with TCP.

Ehm, no.


--
Andy