Re: Endianess problem with capture file from NSLU2
On Wed, Dec 13, 2006 at 04:05:48PM +0100, Thomas Boehne wrote:
> when I capture network traffic on my NSLU2 box with tcpdump, the created
> capture files do not have the proper endianess settings. I could not find
> anything about this problem in the relevant groups or mailing lists. Is
> this a bug in libpcap on nslu2, or does it have something to do with the
> new free ixp network driver? I am using the internal network interface of
> the IXP, not an USB adaptor.
>
> I compared a capture file from my NSLU2 with a proper file from my i686
> machine. Both start with the magic header "d4c3b2a1", indicating the same
> endianess (I am not sure which endianess my NSLU2 is really running with).
> This is what I found in /boot/config-2.6.18-3-ixp4xx:
>
> CONFIG_ARCH_SUPPORTS_BIG_ENDIAN=y
> # CONFIG_CPU_BIG_ENDIAN is not set
>
> Maybe these help:
>
> thomasb@pc-tb-debian:~ 130$ hexdump i686.cap | head
> 0000000 c3d4 a1b2 0002 0004 0000 0000 0000 0000
> 0000010 ffff 0000 0001 0000 ba13 457f fabf 0004
> 0000020 0048 0000 0048 0000 0c00 0029 841c 3000
> ^^^^
> 0000030 3605 0e93 0008 0045 3a00 af57 0040 0640
> ^^^^^^^^^ Represents MAC 00:30:05:36:93:0E
> 0000040 9a78 0a0a 0a3e e0d9 8048 1bc1 3fb4 0549
> 0000050 1282 30e3 eac4 1880 f501 e1c4 0000 0101
> 0000060 0a08 1600 3ce3 3901 aad8 4f44 454e 0a0d
> 0000070 ba13 457f 6a97 0006 0053 0000 0053 0000
> 0000080 3000 3605 0e93 0400 5f0e bc5e 0008 0045
> 0000090 4500 09d3 0040 063a 3503 e0d9 8048 0a0a
> thomasb@pc-tb-debian:~ 0$ hexdump nslu2.cap | head
> 0000000 c3d4 a1b2 0002 0004 0000 0000 0000 0000
> 0000010 ffff 0000 0001 0000 ba13 457f a8d1 0004
> 0000020 004c 0000 004c 0000 1400 66bf 4371 1500
> ^^^^^^^^^^^^^^ Represents MAC00:14:BF:66:71:43
> 0000030 550c 6d4f 0008 0045 3a00 af57 0040 0639
> 0000040 f510 8b57 100e a8c0 d6b2 5af0 8f00 0549
> 0000050 1282 30e3 eac4 1880 f501 adda 0000 0101
> 0000060 0a08 1600 3ce3 3901 aad8 4f44 454e 0a0d
> 0000070 70be 1422 ba13 457f a936 0004 0053 0000
> 0000080 0053 0000 0000 4f6d 0c55 bf66 0014 0800
> 0000090 7143 0045 4500 4000 d309 8e8f 4006 b2d6
Well that dump matches the way my x86 does a dump, which is little
endian. So the header saying little endian matches the contents of the
dump, and also makes sense since the IXP is an intel chip, it is almost
certainly little endian (arm systems come both ways, but more and more
seem to be moving to little endian).
Does the capture not seem to work?
--
Len Sorensen
Reply to: