Endianness of data fields inside BPDU

Question

I'm working on a frame/packet decoder and am seeing inconsistent data regarding the endianness of the MaxAge/Hello/ForwardDelay fields inside a spanning-tree BPDU.

Below is a picture of a wireshark STP decode showing a MaxAge of 20 when the two octets are "14 00". That appears to be little endian (least significant byte first).

I believe the wireshark decode is correct because if the byte order was reversed the MaxAge would be 5120 which is not reasonable.

On the IEEE 802.1d standard 802.1D-2004 section 9.1.1 "Transmission and representation of octets" it says "When consecutive octets are used to represent a binary number, the lower octet number has the most significant value."

URL https://ieeexplore.ieee.org/document/1309630 (but requires a free IEEE account).

The selected bytes 0x002e and 0x002f appear to be correct. The prior 4 bytes are port identifier "80 05" and message age "00 00". Prior to that we have bridge ID ending with "4c 71 0c 19 e3 0d"

Other fields, such as hello time and forward delay, have the same behavior.

Question: Am I misunderstanding something? Or are the 802.1d fields little-endian despite what the standard says?

For reference here's the octets for the BPDU from section 9.3.1 of the spec, although my octet numbering is different because I include the 802.3 header:

a) The Protocol Identifier is encoded in Octets 1 and 2. It takes the value 0000 0000 0000 0000, which identifies the Rapid Spanning Tree Protocol as specified in Clause 17.
NOTE—This value of the Protocol Identifier also identifies the Spanning Tree Algorithm and Protocol specified in previous editions of this standard.
b) The Protocol Version Identifier is encoded in Octet 3. It takes the value 0000 0000.
c) The BPDU Type is encoded in Octet 4. This field takes the value 0000 0000.
This denotes a Configuration BPDU.
d) The Topology Change Acknowledgment flag is encoded in Bit 8 of Octet 5.
e) The Topology Change flag is encoded in Bit 1 of Octet 5.
f) The remaining flags, Bits 2 through 7 of Octet 5, are unused and take the value 0.
g) The Root Identifier is encoded in Octets 6 through 13.
h) The Root Path Cost is encoded in Octets 14 through 17.
i) The Bridge Identifier is encoded in Octets 18 through 25.
j) The Port Identifier is encoded in Octets 26 and 27.
k) The Message Age timer value is encoded in Octets 28 and 29.
l) The Max Age timer value is encoded in Octets 30 and 31.
m) The Hello Time timer value is encoded in Octets 32 and 33.
n) The Forward Delay timer value is encoded in Octets 34 and 35.

Answer 1

The timer fields are not encoded as integer seconds but as a fixed-point number - the first octet means full seconds (more significant), the seconds stands for 1/256 seconds (less significant). 14 00 means 20.000, 14 80 would be 20.500.

This is pretty well hidden in IEEE 802.1Q - where RSTP/MSTP were moved after 802.1D-2004:

14.2.8 Encoding of Timer Values

Timer Values shall be encoded in two octets, taken to represent an unsigned binary number multiplied by a unit of time of 1/256 of a second. This permits times in the range 0 to, but not including, 256 s to be represented.

PS: in 802.1D this was defined in clause 9.2.8.