Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Using Wireshark I am trying to debug an error that I am experiencing with one of my applications. I am having difficulty understanding how the packet contents are being formatted and displayed in Wireshark. To better understand please consider this:

I write the following data as a prefix to a TCP message sent from my application:

1b version buffer, value 52
4b message buffer length, value 1171 

Having applied the appropriate filter, Wireshark displays the following hexadecimal representation for the first 5 bytes of the message:


The first byte 0x34 corresponds to the version buffer I wrote from my application as the decimal representation of 0x34 is in fact 52!

However, the proceeding four bytes to not seem to represent the message buffer length 1171 as per the value I wrote to the buffer from my application.

The hexadecimal value of 1171 is 0x493. I am confused because given the hexadecimal printed in the code block above, the value seems to be correct only it's backwards! Why is this?

share|improve this question
up vote 2 down vote accepted

It's probably an effect of endianness. Bytes can be sent as little endian or big endian, it's only a matter of convenience and hardware support. Apparently your network communication is using little endian, just as Intel-compatible CPUs do in memory.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.