Wireshark · Ethereal-dev: Re: [Ethereal-dev] Field Type for non-8bit-unit field

["Guy Harris" <gharris@xxxxxxxxx>]

Motonori Shindo said:
> Hi,
>
> I found a minor problem in current packet-netflow.c, where it decodes
> "Sample Rate" as a 16bit unsigned integer. According to
>
>     http://www.cisco.com/univercd/cc/td/doc/cisintwk/intsolns/netflsol/nfwhite.htm
>
> Sample Rate is encoded in lower 14bits of 16bits field and higher 2
> bits are used to represent whether the sampling is in use or not. The
> following patch fixes this problem and makes it correctly decode the
> sampling rate, however, it in turn introduces some loss of useful
> information that used to be brought by _header_field_info structure
> (field "abbrev" and "blurb" in particular).
>
> What would be the best way to handle a case like this?

Bitfields.

Have two fields - a sample rate field, in the lower 14 bits, and a field
for the higher 2 bits.

 		{&hf_cflow_samplerate,
 		 {"SampleRate", "cflow.samplerate",
 		  FT_UINT16, BASE_DEC, NULL, 0x3FFF,
 		  "Sample Frequency of exporter", HFILL}
		 },

and a similar field with a mask of 0xC000 for the higher 2 bits.

I've just checked in a change to implement that.