Wireshark-dev: Re: [Wireshark-dev] Portability issue of capture files.
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 07 Sep 2006 03:09:22 -0700
LEGO wrote:


I just tried to open some files with my intel
based minimac and they do not work...


Where were the capture files created, and what application wrote them?


oddly enough capture works only
if you are seeing packets in real-time, if instead you try to capture
without it fails to open them.


What does "wireshark -v" print?

And is Wireshark built from source?


The issue here is that it doesn't appear to be an endianess issue,
No, it's almost certainly not an endianness issue; as Jeff noted, libpcap and wiretap both determine the endianness of a libpcap file from the magic number (which is written in *host* byte order, as are other values in the file header and packet record header), and use that when reading other values from the file and packet record headers.