Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 1163] Dissector bug. ISO8073 COTP protocol.

Date: Wed, 3 Nov 2010 13:34:58 -0700 (PDT)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1163

--- Comment #16 from Chris Maynard <christopher.maynard@xxxxxxxxx> 2010-11-03 13:34:54 PDT ---
OK, I was trying to take a look at this one and while I'm not sure I'll be able
make any further progress than Steve did with his heuristics, right now I'm
confused with something.  The second paragraph of
http://tools.ietf.org/html/rfc905#section-13.2 reads as follows:

     When consecutive octets are used to represent  a  binary  number,
     the lower octet number has the least significant value.

Doesn't this mean this protocol uses little-endian byte ordering?  If so, why
does packet-ositp.c treat all multi-byte fields as big-endian?  What am I
missing?  Am I interpreting it incorrectly?

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.