[ntar-workers] Generic Comments on NTAR format
loris.degioanni at gmail.com
Thu Jun 30 23:59:33 GMT 2005
I wrote "big endian vs little endian" while the issue is exactly the one
described by Guy.
Sorry for the confusion,
Jose M. Gonzalez wrote:
> Michael Richardson wrote:
>> Loris> This is a good idea, but:
>> Loris> - some blocks, like the SHB, cannot have arbitrary codes:
>> Loris> they need magic numbers to handle big endian vs little endian
>> Loris> issues (we discussed quite a lot about this last year on
> I assume here you're thinking about whether using 0xa1b2c3e4 or "ENDI" is
> the best approach for the magic number in the SHB body.
> If you're referring to the block type in an SHB block header, I'm lost.
> I'm not sure whether I understand what difference endianness makes here.
> Either if we use 4-byte integers or 4 1-byte ASCII chars, a parser can't
> guess the block type until it knows the dumper endianness.
> BTW, if you assume the first 4 bytes in the file correspond always to an
> SHB block type, then you can also get the endianness from there. Not
> sure it's worth, though.
> ntar-workers mailing list
> ntar-workers at winpcap.org
More information about the ntar-workers