|
Can I save a trace file from Wireshark with a specific magic_number in the pcap header? I want to choose whether it will be |
|
There is no need to specify whether the magic number is written out in little-endian or big-endian format. Wireshark will read either format on either platform. The magic number identifies the file as a pcap file and how the data is recorded, not how it will be used. I know that wireshark can read boat formats but my question is wheter I can choose how wireshark records data in pcap file. If wireshark can read both formats, can he write in both formats too?
(09 Feb '12, 07:58)
Kosta
The endianness of the output file is whatever the system endianness happens to be; Wireshark makes no specific election to use big-endian or little-endian format.
(09 Feb '12, 08:06)
multipleinte...
Ok. Thanks.
(09 Feb '12, 08:41)
Kosta
|
