Change Endianness (question)

[bucweat]

I’m parsing PCAP files...PCAP headers are little endian however Ethernet/IP/TCP and payload in most cases are big endian. Is it possible to switch endianness while parsing a given type in a typeset?

[RReverser]

Yes, absolutely, this is covered in docs as far as I remember.

[bucweat]

Assuming you are talking about the wiki. Endianness is mentioned when defining typeset. Can this be used in a template?

[RReverser]

I don't think it is, but note that typeset config just changes the default endianness; instead, you can pass it on field-by-field basis as type param by using ['uint16', true] for explicit little-endian and false for big-endian.

[bucweat]

Ah ha!!!!! That is exactly what I was looking for! Thank you :-)

…

On Jul 8, 2018, at 2:06 PM, Ingvar Stepanyan ***@***.***> wrote: I don't think it is, but note that typeset config just changes the default endianness; instead, you can pass it on field-by-field basis as type param by using ['uint16', true] for explicit little-endian and false for big-endian. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#64 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ADy4Sm0jj1lLZvlSuTa-V72nrbaDncnaks5uEnRagaJpZM4VFhy9>.