Endianess problem with capture file from NSLU2

[Thomas Boehne <TBoehne@ADwin.de>]

Hello,

when I capture network traffic on my NSLU2 box with tcpdump, the created
capture files do not have the proper endianess settings. I could not find
anything about this problem in the relevant groups or mailing lists. Is
this a bug in libpcap on nslu2, or does it have something to do with the
new free ixp network driver? I am using the internal network interface of
the IXP, not an USB adaptor.

I compared a capture file from my NSLU2 with a proper file from my i686
machine. Both start with the magic header "d4c3b2a1", indicating the same
endianess (I am not sure which endianess my NSLU2 is really running with).
This is what I found in /boot/config-2.6.18-3-ixp4xx:

CONFIG_ARCH_SUPPORTS_BIG_ENDIAN=y
# CONFIG_CPU_BIG_ENDIAN is not set

Maybe these help:

thomasb@pc-tb-debian:~ 130$ hexdump i686.cap | head
0000000 c3d4 a1b2 0002 0004 0000 0000 0000 0000
0000010 ffff 0000 0001 0000 ba13 457f fabf 0004
0000020 0048 0000 0048 0000 0c00 0029 841c 3000
                                           ^^^^
0000030 3605 0e93 0008 0045 3a00 af57 0040 0640
        ^^^^^^^^^ Represents MAC 00:30:05:36:93:0E
0000040 9a78 0a0a 0a3e e0d9 8048 1bc1 3fb4 0549
0000050 1282 30e3 eac4 1880 f501 e1c4 0000 0101
0000060 0a08 1600 3ce3 3901 aad8 4f44 454e 0a0d
0000070 ba13 457f 6a97 0006 0053 0000 0053 0000
0000080 3000 3605 0e93 0400 5f0e bc5e 0008 0045
0000090 4500 09d3 0040 063a 3503 e0d9 8048 0a0a
thomasb@pc-tb-debian:~ 0$ hexdump nslu2.cap | head
0000000 c3d4 a1b2 0002 0004 0000 0000 0000 0000
0000010 ffff 0000 0001 0000 ba13 457f a8d1 0004
0000020 004c 0000 004c 0000 1400 66bf 4371 1500
                            ^^^^^^^^^^^^^^ Represents MAC00:14:BF:66:71:43
0000030 550c 6d4f 0008 0045 3a00 af57 0040 0639
0000040 f510 8b57 100e a8c0 d6b2 5af0 8f00 0549
0000050 1282 30e3 eac4 1880 f501 adda 0000 0101
0000060 0a08 1600 3ce3 3901 aad8 4f44 454e 0a0d
0000070 70be 1422 ba13 457f a936 0004 0053 0000
0000080 0053 0000 0000 4f6d 0c55 bf66 0014 0800
0000090 7143 0045 4500 4000 d309 8e8f 4006 b2d6

I could provide complete capture files, if that helps.

Relevant package versions:
ii tcpdump                           3.9.5-1
ii libpcap0.8                        0.9.5-1
ii linux-image-2.6.18-3-ixp4xx       2.6.18-7

Thomas Boehne