Revision history  [back]

This may have been explained elsewhere, but not finding it. I have to work within the confines of wireshark 2.4.x. So I defined some values for data as so.

    { &hf_td_timestamp,
        { "Timestamp", "td.timestamp",
            FT_ABSOLUTE_TIME, ABSOLUTE_TIME_LOCAL, NULL, 0x0, NULL, HFILL
        } },
    { &hf_td_timestamp_sec,
        { "Timestamp Seconds", "td.timestamp.sec",
            FT_UINT64, BASE_DEC, NULL, 0x0, NULL, HFILL
        } },
    { &hf_td_timestamp_nsec,
        { "Timestamp nSeconds", "td.timestamp.nsec",
            FT_UINT32, BASE_DEC, NULL, 0x0, NULL, HFILL
        } },

and the data for one of them gets stored and added to the dissect tree as so

    proto_tree_add_item(td_tree, hf_td_timestamp, tvb, offset, 8, ENC_TIME_TIMESPEC);

I only want to display the one line item and not all three. The information for the other two are of course derived from the same bytes. Ultimately I would like to have the other fields available for adding to the columns and not the detail dissect. The timestamp within my payload is 12 bytes, 4 bytes padding then the 8 bytes timestamp as understood by wireshark 2.4.x.
dissect. That is part 1. Once I can establish the storing of the information I will of course add the other two as a single line into the detail as seconds.nanoseconds. The values just need to be stored separately so that the data can be parsed in an Excel csv file. Excel cannot handle the precision of the nanoseconds in decimal format, that is why they must be separate.
Part 2: store some metadata that is calculated from known fields. Specifically the delta between these timestamps. Wireshark can give the delta of the recorded timestamp but not the timestamp within the payload. So basically store the delta between the payload timestamp with the same port information as the last packet from the same port. Once I can get past part 1 then I should be able to accomplish part 2. 2.

So, is there a function that will parse the tvb and only store the value as opposed to store to be displayed?