[File] [PATCH] Magdir/sniffer 5View capture file *.5vw misidentifies kroete.dat

Guy Harris gharris at sonic.net
Mon Mar 21 09:38:20 UTC 2022

On Mar 19, 2022, at 3:01 PM, Jörg Jenderek <joerg.jen.der.ek at gmx.net> wrote:

> According to wireshark source there may exist capture variants
> using big endian order.

Where in the Wireshark source does it speak of big-endian *5View* files?  There are both big-endian and little-endian *pcap* files and big-endian and little-endian sections of *pcapng* files - they're normally written in the byte order of the machine writing the file - but few if any *other* capture file formats work that way.

More information about the File mailing list