ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Ethereal-dev: Re: [Ethereal-dev] slight confusion

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxx>
Date: Thu, 10 May 2001 19:16:39 -0700 (PDT)
> Which leads me to believe that I can use the FIELDBASE and a mask 
> to extract my boolean from some appropriately sized unsigned int type.
> It fails however to indicate which FIELDBASE values correspond 
> to which bitwidths.  

None of them do.

Some FIELDBASE values may happen to have the same binary representation
as some bitwidth values, but that's a different matter; that doesn't
mean there's any way in which a given FIELDBASE value corresponds to a
bitwidth value with the same binary representation, e.g. BASE_BIN
doesn't correspond to a bitwidth value of 4, they just happen to both be
represented as 00000000000000000000000000000100.

"display" is an "int", and can have values, on most if not all of the
platforms on which Ethereal runs, ranging between -2147483648 and
2147483647.

If the field is an FT_INTn or FT_UINTn field, the value of "display" can
be either 1 for BASE_DEC, 2 for BASE_HEX, 3 for BASE_OCT, or 4 for
BASE_BIN (although BASE_BIN isn't actually implemented as "binary" as in
"17 is represented as 00010001 if it's an FT_UINT8", so it's not
currently useful).

If the field is an FT_BOOLEAN and it's a bitfield, the value of
"display" can be 8, 16, 24, or 32 (and possibly other values in between
1 and 32).