Guy
It is a pointer into the data that I have constructed based on the data
in the packet.
There is a lot of packets before these 8 bytes and there is a lot of
packets after these 8 bytes.
I am controlling where I am at with the prt / offset.
Before I was just skipping this packet because I was not sure how to
format it. So I was just doing:
ptr += 8;
offset += 8;
To skip over these 8 bytes.
But now (as you are aware)...I just want to grab these 8 bytes (which is
UTC time since the epoc in milliseconds)....and I want to format it into
some kind of readable date. It doesn't matter the format of the date...
I just want to be able to read it. (for example: 1-21-2010 15:36.... or
something like this).
I also have to figure out if I need to swap these bytes or not as well.
Some of the other packets (that are before these bytes and after these
bytes) I had to swap them first to make sense out of them.
Thanks,
Brian
Guy Harris wrote:
On Jan 21, 2010, at 11:09 AM, Brian Oleksa wrote:
It points to the actual byte that I am at (which is the beginning of the
8 bytes that I need for time).
What are those bytes in? Did you get a pointer to the packet data with tvb_get_ptr(), or is it a pointer into data you've constructed based on the data in the packet?
___________________________________________________________________________
Sent via: Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives: http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe
