I think it might be possible to write this parser using Network Monitors parsing language. It's hard to say for sure, but it should be easy to experiment and see what you get. I glanced at 8583, in particular to understand the bitmaps, and I can talk to
at least one general strategy for handling these. I assume that handling bitmaps is your primary question, but if there are other's please let us know.
If I simplify a bitmap to 1 bytes worth, based on the ISO I understand that each bit determines that some kind of data might exist. So bit 1 (LSB) might be a null terminated ASCII string and bit 2 might be a UINT16 of data. So once you've consumed the bitmap,
you could iterate through each bit and consume the data type that bit represents.
So in this NPL example (which you can build by creating an SParser.npl with only the info below) uses the example above plus bit 3 represents a UINT8.
// Cap example 1: 03 50 50 00 12 34
// Cap example 2: 05 51 51 00 55
// Cap example 3: 06 12 34 55
size = 2
size = 1
[local.bitloc = 1, MaxLoopCount=8]
while [local.bitloc < 8]
[post.local.bitloc = local.bitloc * 2]
case (bitmap & local.bitloc) == 1:
case (bitmap & local.bitloc) == 2:
case (bitmap & local.bitloc) == 4:
Using frame data as represented by the comments at the top you get these, in order:
Let me know if that makes sense and if it was helpful.