In an ISDN trace the hex value is different in the summary and within the hex dump The control field shows 0xEA01, the hex value in the storage dump showa 01ea Why? Wolfgang Schulte woschul at t-online.de asked 24 Sep '16, 02:30  schulte |
This is a static archive of our old Q&A Site.
Please post any new questions and answers at ask.wireshark.org.
I'm afraid the only person who can really answer the question is the author of the dissector.
None of the subfields of the control field is split between the octets, so there is no objective reason why one of the octets should be deemed "LSB" and the other one "MSB". Nor anything in Q.921 implies a particular LSB/MSB role of the octets within the field.
So my speculation is that because in some cases the control field has two octets and in other cases only one, it seemed logical to treat the 4th octet of the frame, which is, depending on the case, either the first one of the two or the only one to be transmitted, as a LSB when displaying the control field as a whole. Because normally you suppress the leading zeroes when printing an integer, not the trailing ones. But doing so causes the endianness of the control field in the dissector to be reverted as compared to the address field.
Does it cause you any practical issue? You can always file a bug at Wireshark bugzilla, and the presence or absence of a practical issue would determine its severity.