This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Can I specify the magic number in pcap files?

0

Can I save a trace file from Wireshark with a specific magic_number in the pcap header? I want to choose whether it will be 0xa1b2c3d4 or 0xd4c3b2a1, which will reflect the endianness of the platforms on which it will be used. Can I do that from Wireshark?

asked 09 Feb '12, 07:02

Kosta's gravatar image

Kosta
1111
accept rate: 0%

edited 09 Feb '12, 07:35

multipleinterfaces's gravatar image

multipleinte...
1.3k152340


One Answer:

0

There is no need to specify whether the magic number is written out in little-endian or big-endian format. Wireshark will read either format on either platform. The magic number identifies the file as a pcap file and how the data is recorded, not how it will be used.

answered 09 Feb '12, 07:33

multipleinterfaces's gravatar image

multipleinte...
1.3k152340
accept rate: 12%

I know that wireshark can read boat formats but my question is wheter I can choose how wireshark records data in pcap file. If wireshark can read both formats, can he write in both formats too?

(09 Feb '12, 07:58) Kosta

The endianness of the output file is whatever the system endianness happens to be; Wireshark makes no specific election to use big-endian or little-endian format.

(09 Feb '12, 08:06) multipleinte...

Ok. Thanks.

(09 Feb '12, 08:41) Kosta