ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-dev: Re: [Wireshark-dev] Why tvb_get_bits() assumes Big Endian?

From: John Thacker <johnthacker@xxxxxxxxx>
Date: Thu, 30 Jul 2020 12:31:57 -0400

On Thu, Jul 30, 2020 at 11:56 AM Tomasz Moń <desowin@xxxxxxxxx> wrote:
On Thu, Jul 30, 2020 at 3:35 PM Filipe Laíns <lains@xxxxxxxxxxxxx> wrote:
> For this reason I decided to drop it in favor of tvb_get_bits_array
> + pletoh*. It is simple enough to be used standalone.

This looks like a workaround to me, not a proper solution.

To me the bit level order within a single byte seems clear - it's up
to the tool that provides data to Wireshark to handle it. Wireshark
job starts at the byte (octet) level.

Maybe here, but consider the FDDI dissector, along with H.223 and BMC, all
of which include wsutil/bitswap.h and call bitswap_buf_inplace()
From what I recall of FDDI, that's because FDDI had the opposite bit order of
Ethernet. Also it used MAC addresses and allowed bridging to Ethernet with
ARPs, so the MAC addresses in the ARP were in the opposite bit order as
the same MAC addresses in the FDDI header.

Certainly there is a special place reserved for people who come up with this,
but if you really do need to reverse the bit level order for an array of bytes, there
is already a function for that.

John Thacker