Wireshark-users: Re: [Wireshark-users] Swapped major/minor question
From: Guy Harris <[email protected]>
Date: Wed, 25 Jun 2008 09:49:07 -0700
sr wrote:
I have two identical files, one in big-endian, the other in little-endian formats.
I assume you're talking about libpcap-format files.

The version number is the same 0x02000400 in both. Wireshark reads both files. Does it mean that the version number is not parsed?
No, because it *is* parsed.

However, Wireshark doesn't require that the major and minor version number be in a narrow range of values - it does check for some particular values, but it accepts just about any value, as long as the major version number is 2 or greater. Libpcap does most of the same stuff that Wireshark does - and doesn't do any additional version number checks - so libpcap-based applications such as tcpdump should also read both files.
If the major version number is 0x02 0x00 and the minor version number is 
0x04 0x00 in a big-endian capture, it will appear to have a major 
version number of 512 and a minor version number of 1024.
However, whatever program wrote the big-endian file should be fixed to 
write out the version number correctly, just in case some other 
software, or some future version of Wireshark or libpcap, makes more 
checks of the version number.