On Mon, 2009-12-07 at 11:38 -0800, Guy Harris wrote: > > I think that preserving the byte order makes sense in order to lean > > against the behavior of the native netdev interface. This is also the > > way libpcap does with ETH_P_ALL devices. Is this correct? > > What does "preserving the byte order" mean here? Putting the fields > into a standard byte order at capture time, or putting them into the > host byte order when reading the file (i.e., byte-swapping them if > you're reading the file on a host with a byte order different from the > byte order of the host on which the file was written)?
Putting them into the host byte order when reading the file. - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
