[pcap-ng-format] The spec does not make it clear what format the block total length is in

Richard Sharpe realrichardsharpe at gmail.com
Sat May 12 13:16:26 PDT 2012


Hi,

In reading this document:
http://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html

it does not make it clear whether or not the block total length is
little endian, big endian, or you have to read the endian magic in the
SHB to figure that out.

Can someone enlighten me please?

-- 
Regards,
Richard Sharpe
(何以解憂?唯有杜康。--曹操)


More information about the pcap-ng-format mailing list