On Thu, Jun 4, 2020 at 5:12 PM Дмитрий Кондратьев <dobreczasy@xxxxxxxxx> wrote:
> Recently I discovered that the parameter Sequence Number for GTP v2 protocol is displayed in such way: "Sequence Number: 0x00ffffff (16777215)"
> But if you see specs then it is stated that Sequence Number is 24-bit field. From my perspective, it doesn't make sense to include two lead zeros.
> Am I missing something? Is it a small UI bug?
If it is a bug, then it is not in the UI, but rather in the dissection engine.
when you look for "gtpv2.sequence_number" in
epan/dissectors/packet-gtpv2.c then you can notice it is marked as
FT_UINT32. Changing it to FT_UINT24 would solve the issue you are
observing. Can you submit a patch to Wireshark gerrit?