Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] displaying more than 32 bits

From: Andreas <AndreasSander1@xxxxxxx>
Date: Sun, 06 Mar 2011 20:32:24 +0100
Am 06.03.2011 15:50, schrieb Yosi Saggi:
Hi everybody

I have a payload  that its size is 42 bits. I am getting it from the TVB
in little Endian.

I have no problem displaying the whole payload as big endian with a
guint 64bit variable:

guint32  f2_val1, f2_val2;
guint64 f2_val;

f2_val1 = tvb_get_letohl(tvb, *plen)
f2_val2 = tvb_get_letohl(tvb, (*plen+4));
f2_val = f2_val1;
f2_val= (f2_val<<32);
f2_val = f2_val|f2_val2;

Are threr any suggestions what can I use to display it correctly. As I
have seen that "proto_tree_add_bits_ret_val", although having a "big
endian/little endian" operand, that "little endian" is not implemented
yet.


If you have a big endian number, than the high part should be *plen, the lower part (*plen)+4 not (*plen+4). The latter is plen[4].

suggestions:

- Check the (*plen+4) term.
- Check that your 32 bit variables have the expected values.
- Check your variable names ;-) I got confused while trying to reproduce it since with the names f2_val and f2_val2. If the code above is not literally from your dissector but "simplified" you probably also have done this failure.

--
Andy