title: What's the difference between a PCAP file with a magic number of "0x4d3cb2a1" and "0xd4c3b2a1"?
body: <p>I've got two PCAP files, <code>A</code> and <code>B</code>.</p>
  
  <p><code>A</code> has a 'magic number' in the header of <code>d4 c3 b2 a1</code>, <code>B</code> has a 'magic number' in the header of <code>4d 3c b2 a1</code>. According to the wireshark documentation (<a href="http://wiki.wireshark.org/Development/LibpcapFileFormat" rel="noreferrer">http://wiki.wireshark.org/Development/LibpcapFileFormat</a>), only <code>0xd4c3b2a1</code> and <code>0xa1b2c3d4</code> are valid magic numbers, which leads me to think that B is not a valid magic number.</p>
  
  <p>Running <code>file</code> on linux backs this up, with the output of <code>file A</code> being:</p>
  
  <pre><code>tcpdump capture file (little-endian) - version 2.4 (Ethernet, capture length 65535)
  </code></pre>
  
  <p><code>file B</code> simply gives:</p>
  
  <pre><code>data
  </code></pre>
  
  <p>It looks like that whatever wrote <code>B</code> wrote it in a 'swapped' (little-endian) format, but wrote the forst twp bytes with the nibbles the wrong way round. Given that I'd expect a big-endian system to write the whole int32 the other way around and not the individual bytes, giving a magic number of <code>1a 2b 3c 4d</code>.</p>
  
  <p>Is <code>B</code> a valid file? If so, why? Can different systems write both 32-bit ints and the individual nibbles in a byte in an arbitrary order?</p>