Wireshark-dev: Re: [Wireshark-dev] Portability issue of capture files.
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 07 Sep 2006 03:13:00 -0700
Andreas Fink wrote:
I'm capturing data on a linux machine (fedora5) with tcpdump -s0 -wdumpfile.cap. Transfer the file to the mac and try to open it with wireshark. I get weird errors saying it couldnt open it because packet size is bigger than 65k or something like that. Same is if I capture with ethereal on that linux box and transfer the file to the mac. 

What happens if you try to read those files with tcpdump on the Mac?


Is this a endian problem maybe?
Not if the Linux machine is an x86-based PC, because an x86-based Mac and an x86-based PC are both little-endian. (The Wireshark binary is either x86-only, or universal with an x86 binary included, right?)