Wireshark-users: Re: [Wireshark-users] Setting up fields with little endianess for a custom disse
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Mon, 17 Mar 2008 18:23:31 -0700

On Mar 17, 2008, at 11:25 AM, Leandro Lucarella wrote:


But I still can't find a way to tell (looked at FT_* and BASE_*
constants) wireshark to interpret the field as little endian.
The byte order is *NOT* a property of the field; there exist protocols (X11 and DCE RPC, to name two) where a given field might appear as little-endian in some packets and big-endian in other packets, even in the same capture.
At least as I read the Wireshark Lua reference manual section of the Wireshark User's Manual, you want to do 

	subtree:add_le(pf, buffer(0, 4))
to add a little-endian 4-byte quantity, but I'm not an expert on the Lua support. Luis?