Using Wireshark I am trying to debug an error that I am experiencing with one of my applications. I am having difficulty understanding how the packet contents are being formatted and displayed in Wireshark. To better understand please consider this:
I write the following data as a prefix to a TCP message sent from my application:
1b version buffer, value 52 4b message buffer length, value 1171
Having applied the appropriate filter, Wireshark displays the following hexadecimal representation for the first 5 bytes of the message:
0x34 0x93 0x04 0x00 0x00
The first byte 0x34 corresponds to the version buffer I wrote from my application as the decimal representation of 0x34 is in fact 52!
However, the proceeding four bytes to not seem to represent the message buffer length 1171 as per the value I wrote to the buffer from my application.
The hexadecimal value of 1171 is 0x493. I am confused because given the hexadecimal printed in the code block above, the value seems to be correct only it's backwards! Why is this?