All, I am running tcpdump-3.7.1 with libpcap-0.7.1 on an i686. tcpdump displays data in sixteen bit units, e.g. 0x0000 011e 5430 0001 0013 ...
It is my understanding that octets on an ethernet line come off the wire most significant bit first (they are "bitwise big endian") but which octet in the sixteen bit unit comes off the wire first? In the example above, is it: (first bit off the wire on the left) 0000 0001 0001 1110 (01 first, then 1e) or 0001 1110 0000 0001 (1e first, then 01) ? James - This is the TCPDUMP workers list. It is archived at http://www.tcpdump.org/lists/workers/index.html To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
