Wireshark mailing list archives
Re: Decode a union type?
From: Alexis La Goutte <alexis.lagoutte () gmail com>
Date: Tue, 31 May 2016 08:03:15 +0200
Hi Gordon, There is no better solution but i think it will be better to always dissect smb2fid. Cheers On Tue, May 31, 2016 at 4:58 AM, Gordon Ross <gordon.w.ross () gmail com> wrote:
I have a type to decode in SMB2, which appears in a couple ioctl calls. The spec. says it's opaque, three "quad" words (8 bytes each). Now I could just not decode it, but we happen to know that most implementations put an SMB2 file ID in there, and it would sometimes be really handy if wireshark could tell us the details about that file ID, if known, but also not make too much of a fuss if it turns out the implementation puts something else there (not a FID). In essence, I want to treat this as a union type: union { quint64 opaque[3]; struct { quint64 persistent; quint64 temporal; quint64 _pad; } smb2fid; } Any suggestions how best to do this? Thanks, Gordon ___________________________________________________________________________ Sent via: Wireshark-dev mailing list <wireshark-dev () wireshark org> Archives: https://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:wireshark-dev-request () wireshark org ?subject=unsubscribe
___________________________________________________________________________ Sent via: Wireshark-dev mailing list <wireshark-dev () wireshark org> Archives: https://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:wireshark-dev-request () wireshark org?subject=unsubscribe
Current thread:
- Decode a union type? Gordon Ross (May 30)
- Re: Decode a union type? Alexis La Goutte (May 30)