c - Interpreting an FT_UNIT32 field as little endian -


i'm in middle of writing wireshark dissector custom protocol. however, have field unsigned 32-bit integer. it's transmitted in little endian form. how force wireshark interpret such?

i.e. hf_register_info struct contains

&hf_foo_length, { "length", "foo.length", ft_uint32, base_dec, null, 0x0, null, hfill } 

and in dissect function i'm calling

proto_tree_add_item(foo_tree, hf_foo_length, tvb, offset, 4, false); 

to answer last question. discovered if last parameter of proto_tree_add_item if non-zero make interpret field little-endian.

see proto.h

/*  * might also, in future, want allow field specifier  * indicate encoding of field, or @ least default  * encoding, fields in protocols use  * same encoding (although that's not true of fields,  * still need able specify @ run time).  *  * so, now, define enc_big_endian , enc_little_endian  * bit flags, combined, in future, other information  * specify encoding in last argument  * proto_tree_add_item(), , possibly specify in field  * definition (e.g., ored in type value).  *  * currently, proto_tree_add_item() treats last argument  * boolean - if it's zero, field big-endian, , if it's non-zero,  * field little-endian - , other code in epan/proto.c  * same.  therefore define enc_big_endian 0x00000000 ,  * enc_little_endian 0x80000000 - we're using high-order bit  * put field type and/or value such character  * encoding in lower bits.  */ 

Comments

Popular posts from this blog

python - Scipy curvefit RuntimeError:Optimal parameters not found: Number of calls to function has reached maxfev = 1000 -

c# - How to add a new treeview at the selected node? -

java - netbeans "Please wait - classpath scanning in progress..." -