[Yaniv Kaul <yaniv.kaul@xxxxxxxxxxxx>]

On Fri, Sep 26, 2025 at 8:57 PM Jaap Keuter <jaap.keuter@xxxxxxxxx> wrote:

Hi,

Well, you setup the header field as FT_UINT24 and with an applicable bit mask. Do this for both items.

Thanks, I ended up with this (working!) code:

#define MAX_PAYLOAD_LENGTH (128 * 1024 - 1) // 128K -1

uint64_t header_data = tvb_get_letoh64(tvb, offset);

header_data &= 0xFFFFFFFFFF; // mask to 40 bits
length = header_data & MAX_PAYLOAD_LENGTH;
uncomp_length = (header_data >> 17) & MAX_PAYLOAD_LENGTH;
 isSelfContained = (header_data >> 34) & 1;  // Self-contained flag at bit 34

Y.

  

Enjoy,

Jaap

PS: Are you sure you didn’t write the spec :p

On 26 Sep 2025, at 18:38, Yaniv Kaul via Wireshark-dev <wireshark-dev@xxxxxxxxxxxxx> wrote:

I promise I did not invent this protocol. See https://github.com/apache/cassandra/blob/608a1b59e29b514ebf0ac77a2f59583c6a3478dc/doc/native_protocol_v5.spec#L144 for specs*.

It's unclear to me - should I just display both values in a single item perhaps? Do something fancy with fetching each independently and then just making some string display of it?

*Yes, it's very clear that ths spec per-se is wrong, saying "The first 4 bytes contain

  an unsigned integer (little endian) containing the compressed and uncompressed
  lengths of the payload and the self contained flag" while each length field is 17bits + 1 bit for the flag, which is >4 bytes...  

I did not write this spec.

TIA,

Y