Search code examples
endiannesspcap

Does edianness in the global header (.pcap) apply only to the header or to the whole pcap file?

I'm writing a program in python3 to analyze a .pcap file and I'm just wondering if the endianness (little endian or big endian) applies to all packets, or just the main header.

Thanks!

Solution

  • It applies to:

    • the file header;
    • the per-packet header (time stamp, captured length, on-the-network length);
    • some meta-data headers in the packet contents (LINKTYPE_NULL, LINKTYPE_USB_LINUX, LINKTYPE_USB_LINUX_MMAPPED, LINKTYPE_IEEE802_11_PRISM, LINKTYPE_NFLOG, LINKTYPE_PFLOG);
    • some fields in the CANbus header in LINKTYPE_LINUX_SLL/LINKTYPE_LINUX_SLL2 captures).

    Other fields in the packet contents are in whatever byte order the protocol containing the field in question specifies - for example, multi-byte integral-valued fields in the IPv4, IPv6, UDP, and TCP headers are big-endian regardless of the endianness of the file and per-packet headers.