Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Patch for reading PCAP files writed on device with different endianess #17

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

Finikssky
Copy link

If pcap file was harvested on device with different endianess (like MIPS BE router), reading pcap header was incorrect. This patch fix it.

@jemcek
Copy link
Owner

jemcek commented May 31, 2019

do you have an examle of such a pcap file, that I could make some tests with the patch?

@Finikssky
Copy link
Author

https://yadi.sk/d/EvIc_dzMrOaXLg - simple arp request in BE
https://yadi.sk/d/M-dAipk1pATv_Q - simple arp request in LE

a1b2 c3d4 0002 0004 0000 0000 0000 0000 0000 ffff 0000 0001 3c0e ac9d 0001 5f33 0000 002a 0000 002a ffff ffff ffff e0d9 e3ac 0cbf 0806 0001 0800 0604 0001 e0d9 e3ac 0cbf c0a8 c0d0 0000 0000 0000 0101 0101 - arp request BE binary text from sublime

d4c3 b2a1 0200 0400 0000 0000 0000 0000 0090 0100 0100 0000 0000 0000 0000 0000 2a00 0000 2a00 0000 ffff ffff ffff e0d9 e3ac 0cbf 0806 0001 0800 0604 0001 e0d9 e3ac 0cbf c0a8 c0d0 0000 0000 0000 0101 0101 - arp request LE binary text from sublime

I create arp_req_le.pcap with packETH on my PC, than i send this pcap from BE device and dump it with tcpdump on device. We can see if we open BE pcap on LE PC - packETH say that there is incorrect format, and if we open LE pcap on BE device - too. Patch fix it by check request header and convert it in host endianess.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants