Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] displaying more than 32 bits

From: Chris Maynard <Chris.Maynard@xxxxxxxxx>
Date: Tue, 8 Mar 2011 05:04:48 +0000 (UTC)
Yosi Saggi <yosis@...> writes:

> I have a payload  that its size is 42 bits. I am getting it from the TVB in
little Endian.
> I have no problem displaying the whole payload as big endian with a guint
64bit variable:
>  
> guint32  f2_val1, f2_val2;
> guint64 f2_val;
>  
> f2_val1 = tvb_get_letohl(tvb, *plen)
> f2_val2 = tvb_get_letohl(tvb, (*plen+4));
> f2_val = f2_val1;
> f2_val= (f2_val<<32);
> f2_val = f2_val|f2_val2;

Why not just grab your 64-bit value like this?
f2_val = tvb_get_letoh64(tvb, *plen);

... and if this thing is really only 42 bits, then you probably need to mask off
some of the irrelevant bits and/or shift as necessary.

> Are threr any suggestions what can I use to display it correctly. As I have
seen that “proto_tree_add_bits_ret_val”, although having a “big endian/little
endian” operand, that “little endian” is not implemented yet.

Correct.  tvb_get_bits[16|32|64] are not yet implemented for little-endian.

> Any help/insight would be much appreciated

Until little-endian support for those functions is added, you likely need to
shift/mask the f2_val to obtain the individual pieces you need, then add them
each separately to the tree using other appropriate proto_tree_add_xyz()
functions, such as proto_tree_add_uint(), etc.