Wireshark · Wireshark-dev: Re: [Wireshark-dev] Decode a union type?

[Alexis La Goutte <alexis.lagoutte@xxxxxxxxx>]

Hi Gordon,

There is no better solution but i think it will be better to always dissect smb2fid.

Cheers

On Tue, May 31, 2016 at 4:58 AM, Gordon Ross <gordon.w.ross@xxxxxxxxx> wrote:

I have a type to decode in SMB2, which appears in a couple ioctl calls.
The spec. says it's opaque, three "quad" words (8 bytes each).  Now I
could just not decode it, but we happen to know that most
implementations put an SMB2 file ID in there, and it would sometimes
be really handy if wireshark could tell us the details about that file
ID, if known, but also not make too much of a fuss if it turns out the
implementation puts something else there (not a FID).

In essence, I want to treat this as a union type:

union {
   quint64  opaque[3];
   struct {
        quint64  persistent;
        quint64 temporal;
        quint64 _pad;
   } smb2fid;
}

Any suggestions how best to do this?

Thanks,
Gordon
___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives:    https://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe