Wireshark · Wireshark-users: Re: [Wireshark-users] filter for jpeg can not use

[chuck c <bubbasnmp@xxxxxxxxx>]

The JPEG dissector (https://code.wireshark.org/review/gitweb?p=wireshark.git;a=blob;f=epan/dissectors/packet-jpeg.c)

   1 /* packet-jpeg.c
   2  *
   3  * Routines for RFC 2435 JPEG dissection

is following RFC 2435 (https://tools.ietf.org/html/rfc2435) which specifies width field:

3.1.5.  Width: 8 bits

   This field encodes the width of the image in 8-pixel multiples (e.g.,
   a width of 40 denotes an image 320 pixels wide).  The maximum width
   is 2040 pixels.

So the field in Wireshark is 8 bits with a max value of 255.

  72 static header_field_info hfi_rtp_jpeg_main_hdr_width JPEG_HFI_INIT = {
  73         "Width",
  74         "jpeg.main_hdr.width",
  75         FT_UINT8, BASE_DEC, NULL, 0,
  76         NULL, HFILL

On Fri, Jun 12, 2020 at 10:42 AM damker <damker@xxxxxxxx> wrote:

Filter "jpeg.main_hdr.width == 640" can not use, it hints that "640 too big for this field, maxinum".

This field encodes the width of the image in 8-pixel multiples (e.g.,a width of 80 denotes an image 640 pixels wide).

If I use "jpeg.main_hdr.width == 80", it means that the number of pixels is 80, and it didn't turn out to be what I wanted (I want that the number of pixels is 640)

, it meight be a bug.

---

damker

 

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    https://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe