Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Ethereal-users: [Ethereal-users] RE: PDML value for sub fields less than 1 byte

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date: Tue, 10 May 2005 16:08:47 +0100
Title: RE: PDML value for sub fields less than 1 byte

    I am using the pdml generated using ethereal as input for various applications.. The problem I am facing is with sub fields which are less than 1 byte (Boolean values).  The value field in the xml file displays the value for the whole byte and not the Boolean value 1 or 0. Is there a way to fix it..

    Example:-

    <field name="tcp.flags" showname="Flags: 0x0018 (PSH, ACK)" size="1" pos="47" show="0x18" value="18">
            <field name="tcp.flags.cwr" showname="0... .... = Congestion Window Reduced (CWR): Not set" size="1" pos="47" show="0" value="18" />

            <field name="tcp.flags.ecn" showname=".0.. .... = ECN-Echo: Not set" size="1" pos="47" show="0" value="18" />
            <field name="tcp.flags.urg" showname="..0. .... = Urgent: Not set" size="1" pos="47" show="0" value="18" />
            <field name="tcp.flags.ack" showname="...1 .... = Acknowledgment: Set" size="1" pos="47" show="1" value="18" />

            <field name="tcp.flags.push" showname=".... 1... = Push: Set" size="1" pos="47" show="1" value="18" />
            <field name="tcp.flags.reset" showname=".... .0.. = Reset: Not set" size="1" pos="47" show="0" value="18" />
            <field name="tcp.flags.syn" showname=".... ..0. = Syn: Not set" size="1" pos="47" show="0" value="18" />
            <field name="tcp.flags.fin" showname=".... ...0 = Fin: Not set" size="1" pos="47" show="0" value="18" />
    </field>

     All the value fields have 18 as their value but for the sub fields it should be just 0 or 1 isn't it...