Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am looking at a packet capture in Wireshark and try to export the data from a packet.

In Wireshark, it looks like this:

46 a5 e2 fb bd 69 ...

Then, after downloading, hexdump shows:

a5 46 fb e2 69 bd ...

The byte order has changed.

Why does this happen, and how can I simply export the data to a file as is? (I just used "Export selected packet bytes...").

share|improve this question
up vote 2 down vote accepted

IP is big-endian, your x86 computer (or your hexdump's default) is little-endian.


Consider this

$ echo foo > foo.txt

$ hexdump foo.txt
0000000 6f66 0a6f

$ hexdump -C foo.txt
00000000  66 6f 6f 0a                                       |foo.|

Especially consider the position of the two o's in foo and the position of the two 6f's in the output of the first hexdump above.

share|improve this answer
OK, so network byte order is always big endian, right? So am I guaranteed that the data I am looking at on my drive is in fact correct, i.e. I don't need to switch the byte order to view it properly? I thought it is gzip data but am unable to inflate it, so I thought that maybe if I switch the byte order I could. Thanks. – mydoghasworms Mar 30 '12 at 5:20
I am willing to accept this answer if it comes with a more detailed explanation, especially answer the question in my previous comment. – mydoghasworms Apr 3 '12 at 7:34
@mydoghasworms: See update. Where do I send the invoice? – RedGrittyBrick Apr 3 '12 at 10:14
Just send to Stack Exchange. Thanks. – mydoghasworms Apr 4 '12 at 5:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .