Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 3540] incorrect timestamps in netscaler capture file forma

Date: Wed, 18 Nov 2009 12:26:57 -0800 (PST)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3540





--- Comment #24 from Ravi Kondamuru <ravikondamuru@xxxxxxxxx>  2009-11-18 12:26:56 PDT ---
(In reply to comment #23)
> 
> So: if I'm not missing something, I expect netscaler.c needs a complete review
> for issues of this type.
> 
> I'm reopening this bug until these issues are resolved ....
> 

I can confirm that all integers written in the file are in little-endian (LE).
sig_EndianType is always ZERO indicating LE. In packet-ns.c, we had explicitly
indicated the endianness when reading from tvb. However in netscaler.c, the
endianness is not handled. Like you and Guy indicated in __ppc__ case, we will
not be getting the intended behavior. I will take a first pass at the code and
send it for review.

I dont see any definitions for letoh[sl]. However there are pletoh[sl]
(epan\pInt.h) macros. These definitions are not ifdef-ed in __ppc__ like how
GUINT_TO_BE (Glibconfig.h) macros are done. There are lots of users of these
macros. Are they susceptible to the same issue? Please comment on this, it will
come in handy as I start reviewing netscaler files.

In any case, thanks for pointing it out. We definitely want to keep all the
capabilities of wireshark intact, while being part of it.

Ravi.


-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.