ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: [Wireshark-dev] Why tvb_get_bits() assumes Big Endian?

From: Tomasz Moń <desowin@xxxxxxxxx>
Date: Thu, 30 Jul 2020 08:06:07 +0200
Hello,

The tvb_get_bits() function family contains following comment:
    /* note that encoding has no meaning here, as the tvb is
considered to contain an octet array */

I don't understand the reason. What am I missing?

The actual octets in tvb contain the bits ordered as expected, so the
MSB/LSB-first problem within the octet itself does not apply (and I
think this is what the comment refers to). However, when the bit field
(e.g. 11 bits) spans across multiple octets, then the endianness does
matter (i.e. which of the two octets contains the more significant
part of the 11-bit value). Simply assuming Big Endian at the
cross-octet boundary prevents USB HID dissection from using
tvb_get_bits() directly because USB uses Little Endian.

Best Regards,
Tomasz Moń