Wireshark Generic Dissector


If you have the following C bitfield :

struct mybitfields
    unsigned short  a : 4;
    unsigned short  b : 5;
    unsigned short  c : 7;

You must define into <your file>.fdesc :

bitfield16  mybitfields
    uint4    a;
    uint5    b;
    uint7    c;

The byte_order apply to the 2 bytes (16 bits in this example).
So, if necessary, the 2 bytes ares inverted before read fields a, b et c inside.

Memory implementation of the example :

bytes before the bitfield   byte 1   byte 2   bytes after the bitfield
if byte_order "motorola"    <-c--->< -b-><-a>
if byte_order "intel"       -b-><-a> <-c---><

BUT, if your memory implementation is this :

bytes before                byte 1   byte  2  bytes after 
                            <-a><-b- ><-c--->

Then, you must NOT use bitfield,
 and use directly uint4, uint5 ... normally.
CSS Template by Rambling Soul