Wireshark-bugs: [Wireshark-bugs] [Bug 3267] Solaris snoop files unsupported
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Wed, 18 Feb 2009 23:51:35 -0800 (PST)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3267





--- Comment #2 from Guy Harris <guy@xxxxxxxxxxxx>  2009-02-18 23:51:31 PDT ---
To quote RFC 1761, "Snoop Version 2 Packet Capture File Format":

    All integer values are stored in "big-endian" order, with the high-
   order bits first.

so the correct thing for code that reads snoop capture files to do is to treat
all integer values in the file - including the version number, as being in
big-endian format.

Was this running on Solaris on a PC - i.e., an Intel-based or AMD-based or...
x86 or x86-64 processor, hence little-endian?

If so, there's probably something wrong with the version of GLib you have, so
that g_ntohl() doesn't work correctly.  The code in Wireshark has, since Day
One, converted that number from host byte order (big-endian) to whatever the
native byte order is, so the code in Wireshark has, since Day One, done the
right thing with the byte order.

Did you build this from source yourself, or did you download some build from
somewhere?


-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.