Ask Your Question
0

PDML output

asked 2022-07-07 13:53:32 +0000

Ke gravatar image

Hi,

I am trying to understand the PDML output from Wireshark. For example, I have an output:

<field name="goose.confRev" showname="confRev: 1" size="1" pos="118" show="1" value="01"/>

And according to the documentation in the Wireshark repo, show is the value we can use for the filter.

My question is, when I have this output for a malformed packet

<field name="_ws.expert.severity" showname="Severity level: Error" size="0" pos="0" show="8388608"/>

<field name="_ws.expert.group" showname="Group: Malformed" size="0" pos="0" show="117440512"/>

is there any special meaning behind the value of show (8388608, 117440512), just like 404 HTTP response.

Best regards

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2022-07-19 02:25:17 +0000

cmaynard gravatar image

These values come from the assignments for the expert severity and groups levels, which are defined in proto.h.

So for example, PI_ERROR is defined as having the hexadecimal value of 0x00800000, which is just the decimal value 8,388,608, and PI_MALFORMED is defined as having the hexadecimal value of 0x07000000, which is just the decimal value 117,440,512.

Here's the full list (as of this writing), copied from proto.h for convenience and with decimal values added in comments:

#define PI_SEVERITY_MASK        0x00F00000  /* mask usually for internal use only! */
#define PI_COMMENT              0x00100000  /* 1,048,576 */
#define PI_CHAT                 0x00200000  /* 2,097,152 */
#define PI_NOTE                 0x00400000  /* 4,194,304 */
#define PI_WARN                 0x00600000  /* 6,291,456 */
#define PI_ERROR                0x00800000  /* 8,388,608 */

#define PI_GROUP_MASK           0xFF000000  /* mask usually for internal use only! */
#define PI_CHECKSUM             0x01000000  /* 16,777,216 */
#define PI_SEQUENCE             0x02000000  /* 33,554,432 */
#define PI_RESPONSE_CODE        0x03000000  /* 50,331,648 */
#define PI_REQUEST_CODE         0x04000000  /* 67,108,864 */
#define PI_UNDECODED            0x05000000  /* 83,886,080 */
#define PI_REASSEMBLE           0x06000000  /* 100,663,296 */
#define PI_MALFORMED            0x07000000  /* 117,440,512 */
#define PI_DEBUG                0x08000000  /* 134,217,728 */
#define PI_PROTOCOL             0x09000000  /* 150,994,944 */
#define PI_SECURITY             0x0a000000  /* 167,772,160 */
#define PI_COMMENTS_GROUP       0x0b000000  /* 184,549,376 */
#define PI_DECRYPTION           0x0c000000  /* 201,326,592 */
#define PI_ASSUMPTION           0x0d000000  /* 218,103,808 */
#define PI_DEPRECATED           0x0e000000  /* 234,881,024 */
edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2022-07-07 13:53:32 +0000

Seen: 210 times

Last updated: Jul 19 '22