Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: [Wireshark-users] value-length in WSP protocol

From: Anne Yu <anne@xxxxxxxxxxxx>
Date: Thu, 28 Feb 2008 10:05:53 -0800
I was using wireshark to test our wsp protocol, and get confused about how the value-length supposed to be used. For example, for a message defined as "value-length field1 field2", it
should be the value length of field1 or the length of field1 + field2?

I cannot find out what version of the specification that wireshark use for wsp. I am testing the wsp base on WAP-230-WSP-20010702-a version 5 July 21. In section 8.4.2.2 Length, it saying "value length is used to indicate the length of the value to follow". So for an example a message like "value-length field1 field2", What should be the value-length?

I try to decode two messages using wireshark, one is based on section 8.4.2.51 Warning field, wireshark seems using the first way, which is value length of the field right next to it.
Warning-value = Value-length Warn-code Warn-agent Warn-text
when I set the Value-length to the length of Warn-code+Warn-agent+Warn-text, wireshark give error; if I set the Value-length to length of Warn-code, it seems decode ok.

Another one I tried is based on section 8.4.2.53 Content-disposition field, which defined as Content-disposition-value = Value-length Disposition *(Parameter), base on the Warning field in section 8.4.2.51, I set the Value-length to the length of Disposition, it decode with error. But if I set the Value-length to the length of Disposition+Parameter, it could decode it.

So I am getting confused about which way wireshark used for value-length. Any idea, comment?
Thanks!

-Anne     anne@xxxxxxxxxxxx




*********************************************************************************************************
"This e-mail (and any attachments) is confidential and privileged information of Catapult Communications"
*********************************************************************************************************