Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] Swapped major/minor question

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 25 Jun 2008 09:49:07 -0700
sr wrote:
I have two identical files, one in big-endian, the other in little-endian formats.

I assume you're talking about libpcap-format files.

The version number is the same 0x02000400 in both. Wireshark reads both files. Does it mean that the version number is not parsed?

No, because it *is* parsed.

However, Wireshark doesn't require that the major and minor version number be in a narrow range of values - it does check for some particular values, but it accepts just about any value, as long as the major version number is 2 or greater. Libpcap does most of the same stuff that Wireshark does - and doesn't do any additional version number checks - so libpcap-based applications such as tcpdump should also read both files.

If the major version number is 0x02 0x00 and the minor version number is 0x04 0x00 in a big-endian capture, it will appear to have a major version number of 512 and a minor version number of 1024.

However, whatever program wrote the big-endian file should be fixed to write out the version number correctly, just in case some other software, or some future version of Wireshark or libpcap, makes more checks of the version number.