Re: [Wireshark-dev] Custom item not related to the packet
Hi Pasqual,
you're right.
I've fixed it using wmem_alloc().
Thanks everyone
Antonello
Il giorno gio 27 mag 2021 alle ore 09:00 Pascal Quantin <
pas...@wireshark.org> ha scritto:
> Hi Antonello
>
> Le jeu. 27 mai 2021 à 08:54, Antonello Tartamo
> a écrit :
>
>> pt contains 16 bytes I have filled up.
>> I'm telling proto_tree_add_item to read these bytes from offset 0 with
>> length 16.
>> The field is properly shown (correct bytes) in the Packet Details tree
>> but when I select it in the Packet Bytes view the bytes selected are not
>> the same shown in the Packet Details view.
>>
>
> I think the real thing to look at (and that you did not share) is the
> lifetime of the pt buffer. Do you ensure that the memory pointed by this
> address is still valid when Wireshark tries to display its content in the
> packet bytes buffer? WIthout seeing this full code part we cannot really
> help you, but you should ensure that pt is valid during the whole pinfo
> structure lifetime (by allocating it in the pinfo->pool memory pool for
> example, see doc/README.wmem file for more details).
>
> Hope this helps,
> Pascal.
>
>
>>
>> Il giorno mer 26 mag 2021 alle ore 15:24 Roland Knall
>> ha scritto:
>>
>>> You misunderstood. pt must contain the bytes you want to be inside the
>>> subset. It seems, that you collect different bytes for this array as you
>>> select for your hf_item selection which is then highlighted in the
>>> packet-view
>>>
>>> kind regard
>>> Roland
>>>
>>> Am Mi., 26. Mai 2021 um 14:39 Uhr schrieb Antonello Tartamo <
>>> antonellotart...@gmail.com>:
>>>
Hello pt is an array (uint8_t pt[16];).
pt is an array generated after processing a part of the packet.
As I've created a new tvb the offset is 0 and the length is 16.
Hope I've answered your questions.
Il giorno mer 26 mag 2021 alle ore 14:32 Roland Knall
ha scritto:
> The data displayed in the subitem is the one from pt, your data
> variable which you used to create the new tvb. The hf_item seems to point
> to a different data structure. How is pt being generated? Are you using
> the
> same length and start offset as for the hf item?
>
> regards
> Roland
>
> Am Mi., 26. Mai 2021 um 08:46 Uhr schrieb Antonello Tartamo <
> antonellotart...@gmail.com>:
>
>> Hello everyone,
>> I'm trying to add a custom item which is not strictly related to the
>> packet but it is coming from a processing of a part of the packet.
>> I've used the following instructions:
>>
>> new_tvb = tvb_new_child_real_data(tvb, pt, (guint)16,
>> 16);
>> add_new_data_source(pinfo, new_tvb, "processed");
>>
>> ti = proto_tree_add_item(data_tree,
>> hf_mp_control_processed, new_tvb, 0, 16, ENC_NA);
>> PROTO_ITEM_SET_GENERATED(ti);
>>
>> hf_mp_control_processed is a set of bytes:
>> { & hf_mp_control_processed ,
>> { "mp control processed", "mp.control.processed",
>> FT_BYTES, BASE_NONE, 0x0, 0x0,
>> NULL, HFILL }
>> }
>>
>> The problem is that when I click on this new item into the Packet
>> Details I see the correct byte values, while in the Packet Bytes view
>> these
>> ones are totally wrong.
>>
>> Attached image:
>> [image: image.png]
>> For example the first byte is 0x48 but 0x68 is shown in the Packet
>> Bytes view.
>>
>> Is there a different way to perform this operation ?
>>
>> Thanks in advance
>>
>> ___
>> Sent via:Wireshark-dev mailing list
>> Archives:https://www.wireshark.org/lists/wireshark-dev
>> Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
>> mailto:wireshark-dev-requ...@wireshark.org
>> ?subject=unsubscribe
>>
>
> ___
> Sent via:Wireshark-dev mailing list
> Archives:https://www.wireshark.org/lists/wireshark-dev
> Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
> mailto:wireshark-dev-requ...@wireshark.org
> ?subject=unsubscribe
>
___
Sent via:Wireshark-dev mailing list
Archives:https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
mailto:wireshark-dev-requ...@wireshark.org
?subject=unsubscribe
>>>
>>> ___
>>> Sent via:Wireshark-dev mailing list
>>> Archives:https://www.wireshark.org/lists/wireshark-dev
>>> Unsubscribe:
Re: [Wireshark-dev] Custom item not related to the packet
Hi Antonello
Le jeu. 27 mai 2021 à 08:54, Antonello Tartamo
a écrit :
> pt contains 16 bytes I have filled up.
> I'm telling proto_tree_add_item to read these bytes from offset 0 with
> length 16.
> The field is properly shown (correct bytes) in the Packet Details tree but
> when I select it in the Packet Bytes view the bytes selected are not the
> same shown in the Packet Details view.
>
I think the real thing to look at (and that you did not share) is the
lifetime of the pt buffer. Do you ensure that the memory pointed by this
address is still valid when Wireshark tries to display its content in the
packet bytes buffer? WIthout seeing this full code part we cannot really
help you, but you should ensure that pt is valid during the whole pinfo
structure lifetime (by allocating it in the pinfo->pool memory pool for
example, see doc/README.wmem file for more details).
Hope this helps,
Pascal.
>
> Il giorno mer 26 mag 2021 alle ore 15:24 Roland Knall
> ha scritto:
>
>> You misunderstood. pt must contain the bytes you want to be inside the
>> subset. It seems, that you collect different bytes for this array as you
>> select for your hf_item selection which is then highlighted in the
>> packet-view
>>
>> kind regard
>> Roland
>>
>> Am Mi., 26. Mai 2021 um 14:39 Uhr schrieb Antonello Tartamo <
>> antonellotart...@gmail.com>:
>>
>>> Hello pt is an array (uint8_t pt[16];).
>>> pt is an array generated after processing a part of the packet.
>>> As I've created a new tvb the offset is 0 and the length is 16.
>>>
>>> Hope I've answered your questions.
>>>
>>>
>>>
>>> Il giorno mer 26 mag 2021 alle ore 14:32 Roland Knall
>>> ha scritto:
>>>
The data displayed in the subitem is the one from pt, your data
variable which you used to create the new tvb. The hf_item seems to point
to a different data structure. How is pt being generated? Are you using the
same length and start offset as for the hf item?
regards
Roland
Am Mi., 26. Mai 2021 um 08:46 Uhr schrieb Antonello Tartamo <
antonellotart...@gmail.com>:
> Hello everyone,
> I'm trying to add a custom item which is not strictly related to the
> packet but it is coming from a processing of a part of the packet.
> I've used the following instructions:
>
> new_tvb = tvb_new_child_real_data(tvb, pt, (guint)16,
> 16);
> add_new_data_source(pinfo, new_tvb, "processed");
>
> ti = proto_tree_add_item(data_tree,
> hf_mp_control_processed, new_tvb, 0, 16, ENC_NA);
> PROTO_ITEM_SET_GENERATED(ti);
>
> hf_mp_control_processed is a set of bytes:
> { & hf_mp_control_processed ,
> { "mp control processed", "mp.control.processed",
> FT_BYTES, BASE_NONE, 0x0, 0x0,
> NULL, HFILL }
> }
>
> The problem is that when I click on this new item into the Packet
> Details I see the correct byte values, while in the Packet Bytes view
> these
> ones are totally wrong.
>
> Attached image:
> [image: image.png]
> For example the first byte is 0x48 but 0x68 is shown in the Packet
> Bytes view.
>
> Is there a different way to perform this operation ?
>
> Thanks in advance
>
> ___
> Sent via:Wireshark-dev mailing list
> Archives:https://www.wireshark.org/lists/wireshark-dev
> Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
> mailto:wireshark-dev-requ...@wireshark.org
> ?subject=unsubscribe
>
___
Sent via:Wireshark-dev mailing list
Archives:https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
mailto:wireshark-dev-requ...@wireshark.org
?subject=unsubscribe
>>>
>>> ___
>>> Sent via:Wireshark-dev mailing list
>>> Archives:https://www.wireshark.org/lists/wireshark-dev
>>> Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
>>> mailto:wireshark-dev-requ...@wireshark.org
>>> ?subject=unsubscribe
>>>
>>
>> ___
>> Sent via:Wireshark-dev mailing list
>> Archives:https://www.wireshark.org/lists/wireshark-dev
>> Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
>> mailto:wireshark-dev-requ...@wireshark.org
>> ?subject=unsubscribe
>>
> ___
> Sent via:Wireshark-dev mailing list
> Archives:https://www.wireshark.org/lists/wireshark-dev
> Unsubscribe:
Re: [Wireshark-dev] Custom item not related to the packet
pt contains 16 bytes I have filled up.
I'm telling proto_tree_add_item to read these bytes from offset 0 with
length 16.
The field is properly shown (correct bytes) in the Packet Details tree but
when I select it in the Packet Bytes view the bytes selected are not the
same shown in the Packet Details view.
Il giorno mer 26 mag 2021 alle ore 15:24 Roland Knall ha
scritto:
> You misunderstood. pt must contain the bytes you want to be inside the
> subset. It seems, that you collect different bytes for this array as you
> select for your hf_item selection which is then highlighted in the
> packet-view
>
> kind regard
> Roland
>
> Am Mi., 26. Mai 2021 um 14:39 Uhr schrieb Antonello Tartamo <
> antonellotart...@gmail.com>:
>
>> Hello pt is an array (uint8_t pt[16];).
>> pt is an array generated after processing a part of the packet.
>> As I've created a new tvb the offset is 0 and the length is 16.
>>
>> Hope I've answered your questions.
>>
>>
>>
>> Il giorno mer 26 mag 2021 alle ore 14:32 Roland Knall
>> ha scritto:
>>
>>> The data displayed in the subitem is the one from pt, your data variable
>>> which you used to create the new tvb. The hf_item seems to point to a
>>> different data structure. How is pt being generated? Are you using the same
>>> length and start offset as for the hf item?
>>>
>>> regards
>>> Roland
>>>
>>> Am Mi., 26. Mai 2021 um 08:46 Uhr schrieb Antonello Tartamo <
>>> antonellotart...@gmail.com>:
>>>
Hello everyone,
I'm trying to add a custom item which is not strictly related to the
packet but it is coming from a processing of a part of the packet.
I've used the following instructions:
new_tvb = tvb_new_child_real_data(tvb, pt, (guint)16,
16);
add_new_data_source(pinfo, new_tvb, "processed");
ti = proto_tree_add_item(data_tree,
hf_mp_control_processed, new_tvb, 0, 16, ENC_NA);
PROTO_ITEM_SET_GENERATED(ti);
hf_mp_control_processed is a set of bytes:
{ & hf_mp_control_processed ,
{ "mp control processed", "mp.control.processed",
FT_BYTES, BASE_NONE, 0x0, 0x0,
NULL, HFILL }
}
The problem is that when I click on this new item into the Packet
Details I see the correct byte values, while in the Packet Bytes view these
ones are totally wrong.
Attached image:
[image: image.png]
For example the first byte is 0x48 but 0x68 is shown in the Packet
Bytes view.
Is there a different way to perform this operation ?
Thanks in advance
___
Sent via:Wireshark-dev mailing list
Archives:https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
mailto:wireshark-dev-requ...@wireshark.org
?subject=unsubscribe
>>>
>>> ___
>>> Sent via:Wireshark-dev mailing list
>>> Archives:https://www.wireshark.org/lists/wireshark-dev
>>> Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
>>> mailto:wireshark-dev-requ...@wireshark.org
>>> ?subject=unsubscribe
>>>
>>
>> ___
>> Sent via:Wireshark-dev mailing list
>> Archives:https://www.wireshark.org/lists/wireshark-dev
>> Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
>> mailto:wireshark-dev-requ...@wireshark.org
>> ?subject=unsubscribe
>>
> ___
> Sent via:Wireshark-dev mailing list
> Archives:https://www.wireshark.org/lists/wireshark-dev
> Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
> mailto:wireshark-dev-requ...@wireshark.org
> ?subject=unsubscribe
>
___
Sent via:Wireshark-dev mailing list
Archives:https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
mailto:wireshark-dev-requ...@wireshark.org?subject=unsubscribe
Re: [Wireshark-dev] Custom item not related to the packet
You misunderstood. pt must contain the bytes you want to be inside the
subset. It seems, that you collect different bytes for this array as you
select for your hf_item selection which is then highlighted in the
packet-view
kind regard
Roland
Am Mi., 26. Mai 2021 um 14:39 Uhr schrieb Antonello Tartamo <
antonellotart...@gmail.com>:
> Hello pt is an array (uint8_t pt[16];).
> pt is an array generated after processing a part of the packet.
> As I've created a new tvb the offset is 0 and the length is 16.
>
> Hope I've answered your questions.
>
>
>
> Il giorno mer 26 mag 2021 alle ore 14:32 Roland Knall
> ha scritto:
>
>> The data displayed in the subitem is the one from pt, your data variable
>> which you used to create the new tvb. The hf_item seems to point to a
>> different data structure. How is pt being generated? Are you using the same
>> length and start offset as for the hf item?
>>
>> regards
>> Roland
>>
>> Am Mi., 26. Mai 2021 um 08:46 Uhr schrieb Antonello Tartamo <
>> antonellotart...@gmail.com>:
>>
>>> Hello everyone,
>>> I'm trying to add a custom item which is not strictly related to the
>>> packet but it is coming from a processing of a part of the packet.
>>> I've used the following instructions:
>>>
>>> new_tvb = tvb_new_child_real_data(tvb, pt, (guint)16,
>>> 16);
>>> add_new_data_source(pinfo, new_tvb, "processed");
>>>
>>> ti = proto_tree_add_item(data_tree,
>>> hf_mp_control_processed, new_tvb, 0, 16, ENC_NA);
>>> PROTO_ITEM_SET_GENERATED(ti);
>>>
>>> hf_mp_control_processed is a set of bytes:
>>> { & hf_mp_control_processed ,
>>> { "mp control processed", "mp.control.processed",
>>> FT_BYTES, BASE_NONE, 0x0, 0x0,
>>> NULL, HFILL }
>>> }
>>>
>>> The problem is that when I click on this new item into the Packet
>>> Details I see the correct byte values, while in the Packet Bytes view these
>>> ones are totally wrong.
>>>
>>> Attached image:
>>> [image: image.png]
>>> For example the first byte is 0x48 but 0x68 is shown in the Packet Bytes
>>> view.
>>>
>>> Is there a different way to perform this operation ?
>>>
>>> Thanks in advance
>>>
>>> ___
>>> Sent via:Wireshark-dev mailing list
>>> Archives:https://www.wireshark.org/lists/wireshark-dev
>>> Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
>>> mailto:wireshark-dev-requ...@wireshark.org
>>> ?subject=unsubscribe
>>>
>>
>> ___
>> Sent via:Wireshark-dev mailing list
>> Archives:https://www.wireshark.org/lists/wireshark-dev
>> Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
>> mailto:wireshark-dev-requ...@wireshark.org
>> ?subject=unsubscribe
>>
> ___
> Sent via:Wireshark-dev mailing list
> Archives:https://www.wireshark.org/lists/wireshark-dev
> Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
> mailto:wireshark-dev-requ...@wireshark.org
> ?subject=unsubscribe
>
___
Sent via:Wireshark-dev mailing list
Archives:https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
mailto:wireshark-dev-requ...@wireshark.org?subject=unsubscribe
Re: [Wireshark-dev] Custom item not related to the packet
Hello pt is an array (uint8_t pt[16];).
pt is an array generated after processing a part of the packet.
As I've created a new tvb the offset is 0 and the length is 16.
Hope I've answered your questions.
Il giorno mer 26 mag 2021 alle ore 14:32 Roland Knall ha
scritto:
> The data displayed in the subitem is the one from pt, your data variable
> which you used to create the new tvb. The hf_item seems to point to a
> different data structure. How is pt being generated? Are you using the same
> length and start offset as for the hf item?
>
> regards
> Roland
>
> Am Mi., 26. Mai 2021 um 08:46 Uhr schrieb Antonello Tartamo <
> antonellotart...@gmail.com>:
>
>> Hello everyone,
>> I'm trying to add a custom item which is not strictly related to the
>> packet but it is coming from a processing of a part of the packet.
>> I've used the following instructions:
>>
>> new_tvb = tvb_new_child_real_data(tvb, pt, (guint)16, 16);
>> add_new_data_source(pinfo, new_tvb, "processed");
>>
>> ti = proto_tree_add_item(data_tree,
>> hf_mp_control_processed, new_tvb, 0, 16, ENC_NA);
>> PROTO_ITEM_SET_GENERATED(ti);
>>
>> hf_mp_control_processed is a set of bytes:
>> { & hf_mp_control_processed ,
>> { "mp control processed", "mp.control.processed",
>> FT_BYTES, BASE_NONE, 0x0, 0x0,
>> NULL, HFILL }
>> }
>>
>> The problem is that when I click on this new item into the Packet Details
>> I see the correct byte values, while in the Packet Bytes view these ones
>> are totally wrong.
>>
>> Attached image:
>> [image: image.png]
>> For example the first byte is 0x48 but 0x68 is shown in the Packet Bytes
>> view.
>>
>> Is there a different way to perform this operation ?
>>
>> Thanks in advance
>>
>> ___
>> Sent via:Wireshark-dev mailing list
>> Archives:https://www.wireshark.org/lists/wireshark-dev
>> Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
>> mailto:wireshark-dev-requ...@wireshark.org
>> ?subject=unsubscribe
>>
> ___
> Sent via:Wireshark-dev mailing list
> Archives:https://www.wireshark.org/lists/wireshark-dev
> Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
> mailto:wireshark-dev-requ...@wireshark.org
> ?subject=unsubscribe
>
___
Sent via:Wireshark-dev mailing list
Archives:https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
mailto:wireshark-dev-requ...@wireshark.org?subject=unsubscribe
Re: [Wireshark-dev] Custom item not related to the packet
The data displayed in the subitem is the one from pt, your data variable
which you used to create the new tvb. The hf_item seems to point to a
different data structure. How is pt being generated? Are you using the same
length and start offset as for the hf item?
regards
Roland
Am Mi., 26. Mai 2021 um 08:46 Uhr schrieb Antonello Tartamo <
antonellotart...@gmail.com>:
> Hello everyone,
> I'm trying to add a custom item which is not strictly related to the
> packet but it is coming from a processing of a part of the packet.
> I've used the following instructions:
>
> new_tvb = tvb_new_child_real_data(tvb, pt, (guint)16, 16);
> add_new_data_source(pinfo, new_tvb, "processed");
>
> ti = proto_tree_add_item(data_tree,
> hf_mp_control_processed, new_tvb, 0, 16, ENC_NA);
> PROTO_ITEM_SET_GENERATED(ti);
>
> hf_mp_control_processed is a set of bytes:
> { & hf_mp_control_processed ,
> { "mp control processed", "mp.control.processed",
> FT_BYTES, BASE_NONE, 0x0, 0x0,
> NULL, HFILL }
> }
>
> The problem is that when I click on this new item into the Packet Details
> I see the correct byte values, while in the Packet Bytes view these ones
> are totally wrong.
>
> Attached image:
> [image: image.png]
> For example the first byte is 0x48 but 0x68 is shown in the Packet Bytes
> view.
>
> Is there a different way to perform this operation ?
>
> Thanks in advance
> ___
> Sent via:Wireshark-dev mailing list
> Archives:https://www.wireshark.org/lists/wireshark-dev
> Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
> mailto:wireshark-dev-requ...@wireshark.org
> ?subject=unsubscribe
>
___
Sent via:Wireshark-dev mailing list
Archives:https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-dev
mailto:wireshark-dev-requ...@wireshark.org?subject=unsubscribe
