[pcap-ng-format] The spec does not make it clear what format the block total length is in
Richard Sharpe
realrichardsharpe at gmail.com
Sat May 12 13:16:26 PDT 2012
Hi,
In reading this document:
http://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html
it does not make it clear whether or not the block total length is
little endian, big endian, or you have to read the endian magic in the
SHB to figure that out.
Can someone enlighten me please?
--
Regards,
Richard Sharpe
(何以解憂?唯有杜康。--曹操)
More information about the pcap-ng-format
mailing list