Wireshark对ping报文的解码显示(BE与LE)

作者:易隐者 发布于:2012-9-25 17:34 Tuesday 分类:网络分析

        我们非常熟悉ping报文的封装结构,但是,在这个报文解码里,我们发现wireshark的解码多了几个参数:Identifier(BE)、Identifier(LE)、Sequence number(BE)、Sequence number(LE),如下图所示: 

点击查看原图

       以前一直未注意wireshark是这样解码ping报文的,感觉非常奇怪,我们先来仔细的看一下wireshark对ping报文中这几个参数的解码情况:

点击查看原图

点击查看原图

点击查看原图

点击查看原图

         Wireshark解码显示,Identifier(BE)与Identifier(LE)都对应“hex 0200”,Sequence number(BE)与Sequence number(LE)都对应“hex 027b”,仔细看的话,我们能够发现BE值(0x0200)与LE值(0x0002)之间的差别就是顺序不一样。那到底BE、LE是指什么呢?搜遍百度无果,决定还是去wireshark官网看看,结果发现下面链接的内容:http://www.wireshark.org/lists/wireshark-bugs/200909/msg00439.html,其中有一段是这样描述的:

“After I discovered that the Windows ping sends ICMP echo request packets with the sequence number in little-endian byte order, but the Linux ping sends it in proper big-endian format, a discussion about it took place on the mailing list as to how to handle it (refer to  http://www.wireshark.org/lists/wireshark-dev/200909/msg00216.html).  However,to keep things simple and avoid adding any new ICMP preferences and/or trying to guess at the byte order, I thought why not just display the sequence number in both formats, so that's what this patch does.”

       我来做个总结:wireshark考虑到window系统与Linux系统发出的ping报文(主要指ping应用字段而非包含IP头的ping包)的字节顺序不一样(windowsLElittle-endian byte orderLinuxBEbig-endian),为了体现wireshark的易用性,开发者将其分别显示出来。

       Wireshark的牛B之处,由此细节可见一斑!

标签: wireshark 解码 ping BE LE little-endian big-endian


您对本文的评分:
当前平均分: 9.7(58 次打分)

版权所有:《蚂蚁网-多维人生,三实而立!》 => 《Wireshark对ping报文的解码显示(BE与LE)
本文地址:http://www.vants.org/?post=133
除非注明,文章均为 《蚂蚁网-多维人生,三实而立!》 原创,欢迎转载!转载请注明本文地址,谢谢。

发表评论:

Powered by 易隐者 基于emlog 皖ICP备12002343号-1