Wireshark · Wireshark-dev: Re: [Wireshark-dev] Portability issue of capture files.

[Jeff Morriss <jeff.morriss@xxxxxxxxxxx>]

Andreas Fink wrote:
> > > Most frequently that's due to using FTP and not setting binary mode.
> > > Does the file's checksum change from machine to machine after copying it?
>
> no.  iIuse scp to copy from machine to machine.

Well, you know, had to ask.  Just in case...  :-)

> > The issue here is that it doesn't appear to be an endianess issue, the
> > file header is read ok, so it is the first packet's, with the second
> > packet I see a very odd thing:
> >
> > pcapio.c writes this:
> >
> > ts_sec 7D91FF44 44FF917D
> > ts_usec 5BE20800 0008E25B
> > incl_len 56010000 00000156
> > orig_len 56010000 00000156
> >
> > wiretap's libpcap.c reads this:
> >
> > ts_sec 07010016 16000107
> > ts_usec CB05E505 05E505CB
> > incl_len 32040A00 000A0432
> > orig_len 01053304 04330501
>
>
> Uh. thats odd.

Yes, very!