Kevin A. Noll wrote: > I'll make that change, but can you point me to an explanation of the > difference between these two? I'm sure it's something to do with unsigned > versus signed,
No. FT_UINT_BYTES means "a counted sequence of bytes" - i.e., a 1-byte to 4-byte number, followed by that number of bytes. If there's no count field, FT_UINT_BYTES shouldn't be used. For a sequence of bytes *not* preceded by a length value giving the number of bytes in the sequence - or for a sequence of bytes where the length value is to be treated as a separate field - FT_BYTES should be used. The unsignedness of the bytes is implicit, as, for opaque sequences of bytes, most if not all of the time you just want to display their hex values, with the uppermost bit being just another bit. The UINT in FT_UINT_BYTES doesn't mean "the bytes are unsigned integers"; it means "the sequence is preceded by an unsigned integer giving the number of bytes in the sequence. Unfortunately, FT_UINT_BYTES isn't documented in README.developer. This is a bug, and I'll look at fixing it. _______________________________________________ Wireshark-dev mailing list [email protected] http://www.wireshark.org/mailman/listinfo/wireshark-dev
