Wireshark decoding display of ping messages (be and LE) transferred from author: Yi Yin

Wireshark decoding display of ping messages (be and LE)

We are very familiar with the package structure of the ping message, but in this message decoding we find that the decoding of Wireshark has several parameters: Identifier (BE), Identifier (LE), Sequence number (BE), Sequence Number (LE), as shown in:

Never notice wireshark is such decoding ping message, it feels very strange, we first to carefully look at the Wireshark of the ping message in the decoding of these parameters:

Wireshark decoding shows that Identifier (BE) and Identifier (le) correspond to "hex 0200", Sequence number (BE) and Sequence number (le) correspond to "Hex 027b", Looking closely, we can see that the difference between the be value (0x0200) and the Le Value (0x0002) is that the order is different. So what is being, le? Search all over Baidu no fruit, decided or go to Wireshark official website to see, results found the following link content: http://www.wireshark.org/lists/wireshark-bugs/200909/msg00439.html, one of which is described as follows:

"After I discovered that the Windows ping sends ICMP echo request packets with the sequence number in Little-endian by Te order, but the Linux Ping sends it in proper Big-endian format, a discussion about it took place on the mailing list as  To how to handle it (refer to http://www.wireshark.org/lists/wireshark-dev/200909/msg00216.html). However,to keep things simple and avoid adding all new ICMP preferences and/or trying to guess at the byte order, I though T why isn't just display the sequence number in both formats and so that's what's this patch does. "

Let me make a summary:Wireshark The byte order of theWindows system with the ping message from the Linux system (mainly the Ping application field rather than the ping packet that contains the IP header) LE:little-endian byte order,Linux is be:Big-endian), in order to reflect the wireshark ease of use, Developers to display them separately.

Wireshark's Cow B, the details can be seen here!

Wireshark decoding display of ping messages (be and LE) is transferred from the invisible person