c - Interpreting an FT_UNIT32 field as little endian -
i'm in middle of writing wireshark dissector custom protocol. however, have field unsigned 32-bit integer. it's transmitted in little endian form. how force wireshark interpret such?
i.e. hf_register_info struct contains
&hf_foo_length, { "length", "foo.length", ft_uint32, base_dec, null, 0x0, null, hfill }
and in dissect function i'm calling
proto_tree_add_item(foo_tree, hf_foo_length, tvb, offset, 4, false);
to answer last question. discovered if last parameter of proto_tree_add_item if non-zero make interpret field little-endian.
see proto.h
/* * might also, in future, want allow field specifier * indicate encoding of field, or @ least default * encoding, fields in protocols use * same encoding (although that's not true of fields, * still need able specify @ run time). * * so, now, define enc_big_endian , enc_little_endian * bit flags, combined, in future, other information * specify encoding in last argument * proto_tree_add_item(), , possibly specify in field * definition (e.g., ored in type value). * * currently, proto_tree_add_item() treats last argument * boolean - if it's zero, field big-endian, , if it's non-zero, * field little-endian - , other code in epan/proto.c * same. therefore define enc_big_endian 0x00000000 , * enc_little_endian 0x80000000 - we're using high-order bit * put field type and/or value such character * encoding in lower bits. */
Comments
Post a Comment