Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 0 down vote favorite

I am looking at a packet capture in Wireshark and try to export the data from a packet.

In Wireshark, it looks like this:

46 a5 e2 fb bd 69 ...

Then, after downloading, hexdump shows:

a5 46 fb e2 69 bd ...

The byte order has changed.

Why does this happen, and how can I simply export the data to a file as is? (I just used "Export selected packet bytes...").

share|improve this question

1 Answer

up vote 2 down vote accepted

IP is big-endian, your x86 computer (or your hexdump's default) is little-endian.

Update:

Consider this

$ echo foo > foo.txt

$ hexdump foo.txt
0000000 6f66 0a6f
0000004

$ hexdump -C foo.txt
00000000  66 6f 6f 0a                                       |foo.|
00000004

Especially consider the position of the two o's in foo and the position of the two 6f's in the output of the first hexdump above.

share|improve this answer
OK, so network byte order is always big endian, right? So am I guaranteed that the data I am looking at on my drive is in fact correct, i.e. I don't need to switch the byte order to view it properly? I thought it is gzip data but am unable to inflate it, so I thought that maybe if I switch the byte order I could. Thanks. – mydoghasworms Mar 30 '12 at 5:20
I am willing to accept this answer if it comes with a more detailed explanation, especially answer the question in my previous comment. – mydoghasworms Apr 3 '12 at 7:34
1  
@mydoghasworms: See update. Where do I send the invoice? – RedGrittyBrick Apr 3 '12 at 10:14
Just send to Stack Exchange. Thanks. – mydoghasworms Apr 4 '12 at 5:59

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.