Why is this unpacked short interpreted incorrectly?

Question

I am unpacking a UDP header (which is itself the payload of an ICMP response). I'm trying to get the source and destination port numbers.

Here's the relevant portion of the code:

udp_head = struct.unpack('HHHH', data[48:56])
print udp_head
print binascii.hexlify(struct.pack('H', udp_head[1]))

Running this gets me the following result:

(42389, 39554, 2048, 61179)
829a

This is part-wrong and part-right. The destination port (the second item in the list) is supposed to be 33434. So it is printing out wrong on the first line. But on the second line, it is correct (0x829A == 33434).

Any ideas why this is happening?

Answer 1

Does this give you a clue?

>>> print hex(33434)
0x829a
>>> print hex(39554)
0x9a82
>>>

It's probably a byte order issue.