Wireshark-dev: [Wireshark-dev] Re: How do I proto_tree_add_item() for a 17(!) bits size field

From: Jaap Keuter <jaap.keuter@xxxxxxxxx>
Date: Fri, 26 Sep 2025 19:57:20 +0200
Hi,

Well, you setup the header field as FT_UINT24 and with an applicable bit mask. Do this for both items.

Enjoy,
Jaap


PS: Are you sure you didn’t write the spec :p


On 26 Sep 2025, at 18:38, Yaniv Kaul via Wireshark-dev <wireshark-dev@xxxxxxxxxxxxx> wrote:

I promise I did not invent this protocol. See https://github.com/apache/cassandra/blob/608a1b59e29b514ebf0ac77a2f59583c6a3478dc/doc/native_protocol_v5.spec#L144 for specs*.

It's unclear to me - should I just display both values in a single item perhaps? Do something fancy with fetching each independently and then just making some string display of it?

*Yes, it's very clear that ths spec per-se is wrong, saying "The first 4 bytes contain
  an unsigned integer (little endian) containing the compressed and uncompressed
  lengths of the payload and the self contained flag" while each length field is 17bits + 1 bit for the flag, which is >4 bytes...  
I did not write this spec.

TIA,
Y