RE: tcpdump endianness
"Viral Mehta" <[email protected]> Fri, 18 Aug 2006 18:22:45 +0530
| Newsgroups | gmane.network.ethereal.devel |
|---|---|
| Message-ID | <[email protected]> |
This is a multi-part message in MIME format. --===============0407135733== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline ------------------- The Ethereal project is being continued at a new site. Please go to http://www.wireshark.org and subscribe to [email protected]. Don't forget to unsubscribe from this list at http://www.ethereal.com/mailman/listinfo/ethereal-dev ------------------- --===============0407135733== Content-Type: multipart/alternative; boundary="----=_NextPart_000_004A_01C6C2F3.4D81EE00" This is a multi-part message in MIME format. ------=_NextPart_000_004A_01C6C2F3.4D81EE00 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Hi, The below sentence in bold letters confuses me. I think I need to swap if I have magic number as "d4c3b2a1" And not when I get it as 0xa1b2c3d4.. M I right? > If endianness is architecture > dependant then how would I know that I have to swap 2 bytes or 4 bytes? You have to swap if the magic number is 0xa1b2c3d4. You have to swap 2 bytes if you have to swap and you're processing a 2-byte quantity. You have to swap 4 bytes if you have to swap and you're processing a 4-byte quantity. Note, by the way, that this applies *ONLY* to the per-file and per-packet headers. It does not apply to the packet data, which is in whatever byte order it was put into on the wire. ------=_NextPart_000_004A_01C6C2F3.4D81EE00 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN"> <HTML> <HEAD> <META HTTP-EQUIV=3D"Content-Type" CONTENT=3D"text/html; = charset=3Dus-ascii"> <META NAME=3D"Generator" CONTENT=3D"MS Exchange Server version = 6.5.7036.0"> <TITLE>RE: [Ethereal-dev] tcpdump endianness</TITLE> </HEAD> <BODY> <!-- Converted from text/rtf format --> <P ALIGN=3DLEFT><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier = New">Hi,</FONT></SPAN></P> <P ALIGN=3DLEFT><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier = New">The below sentence in bold letters confuses me.</FONT></SPAN><SPAN = LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier New"> I think I need to = swap if I have magic number as "d4c3b2a1"</FONT></SPAN></P> <P ALIGN=3DLEFT><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier = New">And not when I get it as</FONT></SPAN><SPAN LANG=3D"en-us"> <FONT = SIZE=3D2 FACE=3D"Courier New">0xa1b2c3d4..</FONT></SPAN></P> <P ALIGN=3DLEFT><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier = New">M I right?</FONT></SPAN><SPAN LANG=3D"en-us"></SPAN></P> <P ALIGN=3DLEFT><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier = New">> If endianness is architecture</FONT></SPAN></P> <P ALIGN=3DLEFT><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier = New">> dependant then how would I know that I have to swap 2 bytes or = 4 bytes?</FONT></SPAN></P> <P ALIGN=3DLEFT><SPAN LANG=3D"en-us"><B><FONT SIZE=3D2 FACE=3D"Courier = New">Y</FONT></B></SPAN><SPAN LANG=3D"en-us"><B></B></SPAN><SPAN = LANG=3D"en-us"><B><FONT FACE=3D"Courier New">ou have to swap if the = magic number is 0xa1b2c3d4.</FONT></B></SPAN><SPAN = LANG=3D"en-us"><B></B></SPAN></P> <P ALIGN=3DLEFT><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier = New">You have to swap 2 bytes if you have to swap and you're processing = a </FONT></SPAN></P> <P ALIGN=3DLEFT><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier = New">2-byte quantity.</FONT></SPAN></P> <P ALIGN=3DLEFT><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier = New">You have to swap 4 bytes if you have to swap and you're processing = a </FONT></SPAN></P> <P ALIGN=3DLEFT><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier = New">4-byte quantity.</FONT></SPAN></P> <P ALIGN=3DLEFT><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier = New">Note, by the way, that this applies *ONLY* to the per-file and = </FONT></SPAN></P> <P ALIGN=3DLEFT><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier = New">per-packet headers. It does not apply to the packet data, = which is in </FONT></SPAN></P> <P ALIGN=3DLEFT><SPAN LANG=3D"en-us"><FONT SIZE=3D2 FACE=3D"Courier = New">whatever byte order it was put into on the wire.</FONT></SPAN></P> </BODY> </HTML> ------=_NextPart_000_004A_01C6C2F3.4D81EE00-- eInfochips Business Disclaimer: This message may contain confidential, proprietary or legally Privileged information. In case you are not the original intended Recipient of the message, you must not, directly or indirectly, use, Disclose, distribute, print, or copy any part of this message and you are requested to delete it and inform the sender. Any views expressed in this message are those of the individual sender unless otherwise stated. Nothing contained in this message shall be construed as an offer or acceptance of any offer by eInfochips Limited and/or eInfochips Inc("eInfochips") unless sent with that express intent and with due authority of eInfochips. eInfochips has taken enough precautions to prevent the spread of viruses. However the company accepts no liability for any damage caused by any virus transmitted by this email. --===============0407135733== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Ethereal-dev mailing list [email protected] http://www.ethereal.com/mailman/listinfo/ethereal-dev --===============0407135733==-- eInfochips Business Disclaimer: This message may contain confidential, proprietary or legally Privileged information. In case you are not the original intended Recipient of the message, you must not, directly or indirectly, use, Disclose, distribute, print, or copy any part of this message and you are requested to delete it and inform the sender. Any views expressed in this message are those of the individual sender unless otherwise stated. Nothing contained in this message shall be construed as an offer or acceptance of any offer by eInfochips Limited and/or eInfochips Inc("eInfochips") unless sent with that express intent and with due authority of eInfochips. eInfochips has taken enough precautions to prevent the spread of viruses. However the company accepts no liability for any damage caused by any virus transmitted by this email.