Wireshark · Ethereal-dev: Re: [Ethereal-dev] Re:[tvb_get_ntohl]

[Ulf Lamping <ulf.lamping@xxxxxx>]

Sofia Altieri wrote:
> Ok, then the fact that tvb_get_ntoh* functions work when sniffing data 
> between my two PCs isn't enough, is it? Should I check every time if 
> data in tvbuff are stored in LE order or not, and depending of the 
> result, change routine?
That just depends on the protocol you're going to dissect. Most 
protocols have a byte order by protocol definition, e.g. TCP uses big 
endian so you'll use the tvb_get_ntoh() function family.

Some protocols use "runtime" definition, e.g. DCE/RPC having a data 
representation field in the packet data describing the current byte 
ordering.

So you'll need to know the protocol specification. If the protocol 
specifies the byte ordering you'll use the appropriate function. If the 
protocol *data* tells you which ordering is currently used you'll have 
to do an if() in your dissector.

Regards, ULFL