Help with data element value in wireshark

Question

Consider the extract from a capture below

Registrar Nonce
 Data Element Type: Registrar Nonce (0x1039)
 Data Element Length: 16
 Registrar Nonce: 3aa9df80bb73ae86a2acb5724da5ad96

When I copy the Registrar Nonce value "3aa9df80bb73ae86a2acb5724da5ad96" and store it in a file in linux..the file size reads 32 bytes instead of 16 bytes (according to the Data Element Length value)..? Which value is correct 16 bytes or 32 bytes?

Accepted Answer

2

Each byte is represented by two hexadecimal characters. For example the most significant byte in your Nonce as the decimal value 58, which is 3a in hexadecimal. So the correct value is 16 bytes.

answered 28 Mar '15, 15:56

Pascal Quantin
5.5k●10●60
accept rate: 30%

thanks for explaining this..so the value "3aa9df80bb73ae86a2acb5724da5ad96" is equal to 32 bytes when stored in a file..is this because each character is considered a byte in the file?

(28 Mar '15, 17:29) Jay Dee

It depends on the encoding used in the file, e.g. using UTF-8 as I think is common on Linux, each hex character is stored as 1 byte, but if using something such as UCS-2, as is common on Windows then there would be two bytes per character (plus a BOM at the front of the file).

(28 Mar '15, 22:01) grahamb ♦

In the packet the binary element is 16 bytes, if yo copy the text representation which is 32 characters and paste it into a text file the length of the text file will be at least 32 bytes depending on how the binary representation of that text string is encoded in the text file.

(29 Mar '15, 00:44) Anders ♦

thank You grahamb and Anders!!

(29 Mar '15, 03:59) Jay Dee