Wireshark · Wireshark-dev: Re: [Wireshark-dev] Why tvb_get_bits() assumes Big Endian?

[Jaap Keuter <jaap.keuter@xxxxxxxxx>]

:)

On 30 Jul 2020, at 09:19, Tomasz Moń <desowin@xxxxxxxxx> wrote:

On Thu, Jul 30, 2020 at 8:58 AM Tomasz Moń <desowin@xxxxxxxxx> wrote:

On Thu, Jul 30, 2020 at 8:30 AM Jaap Keuter <jaap.keuter@xxxxxxxxx> wrote:

Let’s put a hypothetical here, a 7 bit value spanning 2 octets:

15 14 13 12 11 10  9  8| 7  6  5  4  3  2  1  0
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
|  |  |  |  |  |  | 6| 5| 4| 3| 2| 1| 0|  |  |  |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+

This would be the typical interpretation, as seen in network protocols.

Your suggestion is that the interpretation can also be:

15 14 13 12 11 10  9  8| 7  6  5  4  3  2  1  0
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
|  |  |  |  |  |  | 1| 0| 6| 5| 4| 3| 2|  |  |  |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+

This is not what I wanted to write. Assuming you meant two octets, and
the bitmask on the 16-bit value is 0x1FC0 then the alternative
interpretation would be:
 15 14 13 12 11 10  9  8| 7  6  5  4  3  2  1  0
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+
|  |  |  |  |  |  | 4| 3| 2| 1| 0| 6| 5|  |  |  |
+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+--+

Sorry, I should have displayed that in a fixed font earlier! It is
perfectly clear then (the bitmask in your example is 0x03F8, and not
0x1FC0 as I was led to believe due to trying to figure it out on font
not suited for the task)