Ethereal-dev: [Ethereal-dev] Ring buffer capture causes "corrupt" captures

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: "Visser, Martin (Sydney)" <Martin.Visser@xxxxxx>
Date: Mon, 17 Feb 2003 14:54:30 +1100
Title: Ring buffer capture causes "corrupt" captures

Hi

I just have been playing ring buffer capture and noticed a problem. I am running on Windows 2000 with WinPcap 2.3

tethereal -n -i '\Device\Packet_{BC59957C-453C-4A7E-B296-13C024AFEF80}' -a filesize:10 -w cap.pcap -b 3

Produces files cap.pcap, cap.pcap.001….  (all around 10K long)

If I then try to read the files, (with "tethereal -n -r pcap.cap", they seem to read OK, but I something like the following message:

Message: pcap: File has 538976288-byte packet, bigger than maximum of 65535
tethereal: "cap.pcap" appears to be damaged or corrupt.

What gives?


Martin Visser
Network Consultant
Technology & Infrastructure - Consulting & Integration
HP Services
3 Richardson Place
North Ryde, Sydney NSW 2113, Australia
Phone (: +61-2-9022-1670    Mobile È: +61-411-254-513
   Fax 7: +61-2-9022-1800     E-mail + : martin.visserAThp.com