欢迎关注:1,欢迎关注本博客,你可点击右手边的【QQ邮件订阅】订阅本博客!2,本博客推出江湖救急计划,主要为工作中遇到疑难杂症的兄弟提供远程技术支持和分析,如有需要,请在江湖救急计划页面给我留言!

Wireshark对ping报文的解码显示(BE与LE)

作者:易隐者 发布于:2012-9-25 17:34 Tuesday 分类:网络分析

        我们非常熟悉ping报文的封装结构,但是,在这个报文解码里,我们发现wireshark的解码多了几个参数:Identifier(BE)、Identifier(LE)、Sequence number(BE)、Sequence number(LE),如下图所示: 

点击查看原图

       以前一直未注意wireshark是这样解码ping报文的,感觉非常奇怪,我们先来仔细的看一下wireshark对ping报文中这几个参数的解码情况:

点击查看原图

点击查看原图

点击查看原图

点击查看原图

         Wireshark解码显示,Identifier(BE)与Identifier(LE)都对应“hex 0200”,Sequence number(BE)与Sequence number(LE)都对应“hex 027b”,仔细看的话,我们能够发现BE值(0x0200)与LE值(0x0002)之间的差别就是顺序不一样。那到底BE、LE是指什么呢?搜遍百度无果,决定还是去wireshark官网看看,结果发现下面链接的内容:http://www.wireshark.org/lists/wireshark-bugs/200909/msg00439.html,其中有一段是这样描述的:

“After I discovered that the Windows ping sends ICMP echo request packets with the sequence number in little-endian byte order, but the Linux ping sends it in proper big-endian format, a discussion about it took place on the mailing list as to how to handle it (refer to  http://www.wireshark.org/lists/wireshark-dev/200909/msg00216.html).  However,to keep things simple and avoid adding any new ICMP preferences and/or trying to guess at the byte order, I thought why not just display the sequence number in both formats, so that's what this patch does.”

       我来做个总结:wireshark考虑到window系统与Linux系统发出的ping报文(主要指ping应用字段而非包含IP头的ping包)的字节顺序不一样(windowsLElittle-endian byte orderLinuxBEbig-endian),为了体现wireshark的易用性,开发者将其分别显示出来。

       Wireshark的牛B之处,由此细节可见一斑!

阅读全文>>

标签: wireshark 解码 ping BE LE little-endian big-endian

评论(0) 引用(0) 浏览(48387)

Powered by 易隐者 基于emlog 皖ICP备12002343号-1