Wireshark-dev: Re: [Wireshark-dev] Portability issue of capture files.

From: Jeff Morriss <jeff.morriss@xxxxxxxxxxx>
Date: Thu, 07 Sep 2006 16:22:23 +0800


Andreas Fink wrote:

Most frequently that's due to using FTP and not setting binary mode.
Does the file's checksum change from machine to machine after copying it?

no.  iIuse scp to copy from machine to machine.

Well, you know, had to ask.  Just in case...  :-)

The issue here is that it doesn't appear to be an endianess issue, the
file header is read ok, so it is the first packet's, with the second
packet I see a very odd thing:

pcapio.c writes this:

ts_sec 7D91FF44 44FF917D
ts_usec 5BE20800 0008E25B
incl_len 56010000 00000156
orig_len 56010000 00000156

wiretap's libpcap.c reads this:

ts_sec 07010016 16000107
ts_usec CB05E505 05E505CB
incl_len 32040A00 000A0432
orig_len 01053304 04330501


Uh. thats odd.

Yes, very!