Wireshark-dev: [Wireshark-dev] Dissecting a field that has non-octet bit boundaries
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Richard Sharpe <realrichardsharpe@xxxxxxxxx>
Date: Thu, 22 Jan 2015 20:46:15 -0800
Hi Folks,

I am trying to dissect MS-RSVD further since I have a capture of some
of that funky SCSI tunneled over SMB2/3.

Anyway, they have a 4-byte header that consists of:

1 byte:  Protocol ID
12 bits: Protocol Version
12 bits: Operation Code

How do I deal with this. It does not seem like proto_tree_add_bitmask
is the correct thing.

-- 
Regards,
Richard Sharpe
(何以解憂？唯有杜康。--曹操)