Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
In WinHex, I can use the Data Interpreter tool to see the numeric interpretation of data starting from the currently selected byte. This considerably simplifies the initial analysis of the data structures.
Is there a similar way to quickly lookup basic type values in Wireshark without having to define or export the underlying data structures first?
In a word: no.
Wireshark's design includes the fundamental notion of a dissector. Each dissector is responsible for the interpretation of streams of bytes according the the corresponding protocol, so an IEEE 802.3 frame, for instance, is correctly broken into its constituent pieces based on the definitions in that standard.
However, it is possible (and encouraged!) to write one's own dissectors and to contribute them to the project, so one can imagine writing a dissector that would present the data somewhat in the manner you've described. Because the typical dissector interprets each byte in only one way, a dissector for the purpose you describe would have to be a little different than the usual, but not impossible.
Another possibility would be to add a Lua extension. Recent versions of Wireshark incorporate a Lua interpreter and Lua scripts have access to the underlying data.
Although I've written both dissectors and Lua scripts, my own experience is much more with dissectors than scripts; for that reason, I'd probably attempt this as a dissector if I were to write it.
Another option would be to export the raw binary for particular packets and then use either WinHex or a more specific tool such as Netzob to aid in reverse engineering the protocol.
