We're now a non-profit! Support open source packet analysis by making a donation.

Wireshark-dev: Re: [Wireshark-dev] need to read three bytes of offset

From: prashanth joshi <[email protected]>
Date: Thu, 4 Mar 2010 12:42:06 -0800 (PST)
Hi Guy Harris,
thanks for the clarification.
I was writing a function to read such 3 byte values and convert them to int. Unaware that uint24 field is supported in C (I have seen uint24 field only in wireshark).
Now I am using the uint24 type.

--- On Thu, 3/4/10, Guy Harris <[email protected]> wrote:

From: Guy Harris <[email protected]>
Subject: Re: [Wireshark-dev] need to read three bytes of offset
To: "Developer support list for Wireshark" <[email protected]>
Date: Thursday, March 4, 2010, 2:35 PM

On Mar 4, 2010, at 12:00 PM, prashanth s wrote:

> Nopes. But the values that appear in the pcap -  for example,  ba cf need to be interpreted by my parser as ba cf(this is the value,for example, that the company talks about. Hence it may be assumed that the byte order followed by the company is Big Endian.

If you mean that fields in that protocol other than the 3-byte field are big-endian, then...

> So would this mean that the 3 bytes appearing on the pcap also follow the Big Endianness?

...that means that the 3-byte field is probably also big-endian.
Sent via:    Wireshark-dev mailing list <[email protected]>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:[email protected]?subject=unsubscribe