This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Decode double-precision float in big-endian order

I used WireShark to capture this double-precision float from ethernet: 40 39 64 15 85 15 4f 4f Basic format understanding: [sign bit][11 bit exponent][52 bit mantissa] = 64 bit value I believe it's in big-endian order, equivalent to approximately 52,000 decimal. No matter how I order the bytes it never comes out right.
Does the data look reasonable? How to decode properly? Good online tool available? I just need to convert it (and MANY other numbers like it), I don't need to understand the process. Thanks in advance for your help.

big-endian double-precision

asked 02 Nov '12, 09:30

Roy L Payne
1●1●1●1
accept rate: 0%

3 Answers:

http://www.binaryconvert.com/result_double.html

52000 would be 0x40E9640000000000, so no matter if you use big/little endian, you will not end up with your hex representation.

So, where did capture that double float and how do you know it's the representation of the double float value 52000?

Can you post the capture file that contains that value (on cloudshark.org)?

Regards
Kurt

answered 02 Nov '12, 09:42

Kurt Knochner ♦
24.8k●10●39●237
accept rate: 15%

Kurt, thanks for feedback. I'm Richard (Roy L Payne), and comparing your number with mine, I realized I typo'd part of it ('39' should be 'e9'). So mine starts with "40 e9 64", which matches the start of your number. I'll have to track down what all that other garbage is in my value. About posting files, it won't be possible. Thanks again for your help.

(02 Nov '12, 09:55) Roy L Payne

The "other garbage" may be "it's approximately 52000, not exactly 52000".

(02 Nov '12, 15:09) Guy Harris ♦♦

if you use the online converter (see link above), you will get the decimal representation.

http://www.binaryconvert.com/result_double.html?hexadecimal=40E9641585154F4F

Result: 5.20006724955128665897063910961E4

So, the rest is not really "garbage", but an essential part of the value, if it's a double float value. As @Guy Harris said: It's approximately 52000. And that's what you also assumed in your question:

I believe it's in big-endian order, equivalent to approximately 52,000 decimal.

So, I think the puzzle is solved ;-)

Regards
Kurt

(04 Nov '12, 01:36) Kurt Knochner ♦

If you need the value for some reason other than to simply display it, you can use tvb_get_ntohieee_double(); otherwise, if you're just going to display it in the tree, use proto_tree_add_item() where the hf_ field has a type of FT_DOUBLE. Refer to doc/README.developer, epan/tvbuff.[h|c] and various dissector source files for further help and examples.

answered 02 Nov '12, 13:00

cmaynard ♦♦
9.4k●10●38●142
accept rate: 20%

Scripting

If you have more hex strings than is convenient for manual entry, I would employ scripting. You could even use this Python script directly in codepad.

IEEE-754 Analysis from CUNY

I like using the IEEE-754 Analysis page to convert hex strings (copied from Wireshark/Tshark or similar tools) to decimal values. It also converts decimal floating-point to hex string, handles endianness, and displays the conversion in different precisions.

Instructions

Open the page for IEEE-754 Analysis. Keep the default settings unless you need to tweak them.
Copy and paste your hex string (40e9641585154f4f) into the textbox for Value to analyze.
Press Enter. Assuming you left the Input Mode as auto, It should automatically convert your hex string into a decimal value (shown in E notation), and show binary conversions in multiple precisions.

answered 02 Nov '12, 18:11

helloworld
3.1k●4●20●41
accept rate: 28%