Can I save a trace file from Wireshark with a specific magic_number in the pcap header? I want to choose whether it will be asked 09 Feb '12, 07:02  Kosta edited 09 Feb '12, 07:35  multipleinte... |
One Answer:
There is no need to specify whether the magic number is written out in little-endian or big-endian format. Wireshark will read either format on either platform. The magic number identifies the file as a pcap file and how the data is recorded, not how it will be used. answered 09 Feb '12, 07:33 multipleinte... |
I know that wireshark can read boat formats but my question is wheter I can choose how wireshark records data in pcap file. If wireshark can read both formats, can he write in both formats too?
The endianness of the output file is whatever the system endianness happens to be; Wireshark makes no specific election to use big-endian or little-endian format.
Ok. Thanks.