Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 5370] Add support for USB isochronous

Date: Fri, 5 Nov 2010 16:31:45 -0700 (PDT)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=5370

--- Comment #6 from Guy Harris <guy@xxxxxxxxxxxx> 2010-11-05 16:31:44 PDT ---
 - how are the bytes of a realtime capture arrive to wireshark on little-endian
and big endian computers?

They arrive in whatever format the USB monitoring code delivers them, which I
think is "host byte order".

 - what happens if the capture file which contains caputred USB packets on
little-endian computer is transfered to a big-endian computer and opened there
in Wireshark?

Most of the Linux pseudo-header is byte-swapped by the Wiretap code, so that
most of the fields in the Linux pseudo-header are in the byte order appropriate
for the host reading the file.

The fields in the data[8] portion of the pseudo-header are *NOT* modified in
any fashion, so any multi-byte quantities put there by host code, rather than
being copied from the (little-endian, I think) USB setup information, will be
in the byte order of the host that *wrote* the file.

The same is true of the isochronous descriptors - they are *NOT* examined, and
*NOT* byte-swapped, by the Wiretap code.

The same applies to the libpcap code, so any program that uses libpcap to read
USB captures would have the same issues as Wireshark.

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.