Ethereal-dev: Re: [Ethereal-dev] Bug in compressed sniffer file decode

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 3 Sep 2003 11:11:28 -0700

On Wednesday, September 3, 2003, at 9:12 AM, Greg Morris wrote:

I created the caz file by performing a file/save as from within NAI Sniffer version 4.7. There are no problems opening or manipulating this file from within Sniffer.

Well, that's not exactly a surprise. :-)

 The only problems encountered are those with Ethereal.

As noted, they're probably using some feature of the compressed file format that the code we're currently using doesn't support.

Should the Ethereal support for caz files be modified to extact the file to a temporary file for manipulation? Seems like the first extract/dissection works as desired.

I wouldn't assume that. It *might* be that the initial sequential pass is working and random access isn't, but there might be some problems in the first sequential pass that we just haven't seen yet.

Also, it's not clear how to distinguish .caz files from other files in GZIP format.