ip: ip.flags field are 3 high bits not full byte

See https://ask.wireshark.org/question/27546/0x01-flag-on-last-of-fragmented-packets/
This commit is contained in:
Chuck Craft 2022-06-12 11:35:59 -05:00 committed by Guy Harris
parent 4f283e9ef8
commit 208cf56b75
5 changed files with 21 additions and 14 deletions

6
NEWS
View File

@ -49,6 +49,10 @@ Wireshark 3.7.1 Release Notes
• You must now have a compiler with C11 support in order to build
Wireshark.
• The ip.flags field is now only the three high bits, not the full
byte. Display filters or Coloring rules using the field will need
to be adjusted.
Many other improvements have been made. See the “New and Updated
Features” section below for more details.
@ -306,7 +310,7 @@ Wireshark 3.7.1 Release Notes
A complete FAQ is available on the Wireshark web site[7].
Last updated 2022-06-10 19:05:47 UTC
Last updated 2022-06-12 16:30:07 UTC
References

View File

@ -49,6 +49,9 @@ wsbuglink:17779[]
* You must now have a compiler with C11 support in order to build Wireshark.
* The ip.flags field is now only the three high bits, not the full byte. Display filters or
Coloring rules using the field will need to be adjusted.
Many other improvements have been made.
See the “New and Updated Features” section below for more details.

View File

@ -2612,7 +2612,7 @@ proto_register_ip(void)
{ &hf_ip_flags,
{ "Flags", "ip.flags", FT_UINT8, BASE_HEX,
NULL, 0x0, "Flags (3 bits)", HFILL }},
NULL, 0xE0, "Flags (3 bits)", HFILL }},
{ &hf_ip_flags_sf,
{ "Security flag", "ip.flags.sf", FT_BOOLEAN, 8,

File diff suppressed because one or more lines are too long

View File

@ -339,10 +339,10 @@
5
],
"ip.flags_raw": [
"00",
"0",
20,
1,
0,
224,
4
],
"ip.flags_tree": {
@ -1213,10 +1213,10 @@
5
],
"ip.flags_raw": [
"00",
"0",
20,
1,
0,
224,
4
],
"ip.flags_tree": {
@ -2105,10 +2105,10 @@
5
],
"ip.flags_raw": [
"00",
"0",
20,
1,
0,
224,
4
],
"ip.flags_tree": {
@ -3009,10 +3009,10 @@
5
],
"ip.flags_raw": [
"00",
"0",
20,
1,
0,
224,
4
],
"ip.flags_tree": {