From be984135ac86f257f0f238789b7d8b3d24530912 Mon Sep 17 00:00:00 2001 From: Srivats P Date: Thu, 4 Jun 2020 21:02:09 +0530 Subject: [PATCH] Fix diff in pcap import of IPv4 due to ip.flags Some Wireshark/tshark versions have ip.flags as u16 instead of u8. Code changed to be able to handle both. Tested with Wireshark 3.2.4 (u16) and 1.14 (u8) --- common/ip4pdml.cpp | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/common/ip4pdml.cpp b/common/ip4pdml.cpp index a47a83c..554bd7d 100644 --- a/common/ip4pdml.cpp +++ b/common/ip4pdml.cpp @@ -73,7 +73,9 @@ void PdmlIp4Protocol::unknownFieldHandler(QString name, int /*pos*/, { OstProto::Ip4 *ip4 = pbProto->MutableExtension(OstProto::ip4); - ip4->set_flags(attributes.value("value").toString().toUInt(&isOk, kBaseHex) >> 5); + int shift = attributes.value("size").toString().toUInt(&isOk) == 2 ? + 13 : 5; + ip4->set_flags(attributes.value("value").toString().toUInt(&isOk, kBaseHex) >> shift); } }