Problem when parsing the Event object

[rosenfl]

I get wrong info when I used the code with the Class 'Event' on Linux.

I changed the Class Event to: (ntohl)
import socket

class SfTimeval32(object):
_PACK_STR = '!II'
_SIZE = 8

def __init__(self, tv_sec, tv_usec):
    self.tv_sec = socket.ntohl(tv_sec)
    self.tv_usec = socket.ntohl(tv_usec)

class Event(object):
_PACK_STR = '!IIIIIII'
_SIZE = 36

def __init__(self, sig_generator, sig_id, sig_rev, classification,
             priority, event_id, event_reference, ref_time):
    self.sig_generator = socket.ntohl(sig_generator)
    self.sig_id = socket.ntohl(sig_id)
    self.sig_rev = socket.ntohl(sig_rev)
    self.classification = socket.ntohl(classification)
    self.priority = socket.ntohl(priority)
    self.event_id = socket.ntohl(event_id)
    self.event_reference = socket.ntohl(event_reference)
    self.ref_time = ref_time

@classmethod
def parser(cls, buf, offset):
    """

    :param buf:
    :param offset:
    :return:
    """
    (sig_generator, sig_id, sig_rev, classification, priority,
     event_id, event_reference) = struct.unpack_from(
         cls._PACK_STR, buf, offset)
    offset += calcsize(cls._PACK_STR)
    # removing 1 to offset to avoid crash because the buffer is smaller
    ref_time = SfTimeval32.parser(buf, offset**-1**)

    msg = cls(sig_generator, sig_id, sig_rev, classification,
              priority, event_id, event_reference, ref_time)

    return msg

class PcapPktHdr32(object):
"""
Class PcapPktHdr32
"""
_PACK_STR = '!II'
_SIZE = 16

def __init__(self, ts, caplen, len_):
    self.ts = ts
    self.caplen = socket.ntohl(caplen)
    self.len = socket.ntohl(len_)

In
class AlertPkt(object):

@classmethod
def parser(cls, buf):
    """

    :param buf:
    :return:
    """
    alertmsg = struct.unpack_from(cls._ALERTMSG_PACK_STR, buf)
    offset = calcsize(cls._ALERTMSG_PACK_STR)

    pkth = PcapPktHdr32.parser(buf, offset)
    offset += PcapPktHdr32._SIZE

    (dlthdr, nethdr, transhdr, data, val, pkt) = \
        struct.unpack_from(cls._ALERTPKT_PART_PACK_STR, buf,
                           offset)
    offset += calcsize(cls._ALERTPKT_PART_PACK_STR)
    # Adding 1 to offset to get good event values. Some problem in c++ perhaps
    event = Event.parser(buf, offset**+1**)

[kevin-hogan]

My response to another reported issue (#4) might be relevant here.

[mzy2240]

Changing the time decoding from big endian to little endian solves my problem.