Wireshark mailing list archives

Re: displaying more than 32 bits


From: Andreas <AndreasSander1 () gmx net>
Date: Sun, 06 Mar 2011 20:32:24 +0100

Am 06.03.2011 15:50, schrieb Yosi Saggi:
Hi everybody

I have a payload  that its size is 42 bits. I am getting it from the TVB
in little Endian.

I have no problem displaying the whole payload as big endian with a
guint 64bit variable:

guint32  f2_val1, f2_val2;
guint64 f2_val;

f2_val1 = tvb_get_letohl(tvb, *plen)
f2_val2 = tvb_get_letohl(tvb, (*plen+4));
f2_val = f2_val1;
f2_val= (f2_val<<32);
f2_val = f2_val|f2_val2;

Are threr any suggestions what can I use to display it correctly. As I
have seen that "proto_tree_add_bits_ret_val", although having a "big
endian/little endian" operand, that "little endian" is not implemented
yet.


If you have a big endian number, than the high part should be *plen, the lower part (*plen)+4 not (*plen+4). The latter is plen[4].

suggestions:

- Check the (*plen+4) term.
- Check that your 32 bit variables have the expected values.
- Check your variable names ;-) I got confused while trying to reproduce it since with the names f2_val and f2_val2. If the code above is not literally from your dissector but "simplified" you probably also have done this failure.

--
Andy

___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
            mailto:wireshark-dev-request () wireshark org?subject=unsubscribe


Current thread: