Ethereal-dev: Re: [Ethereal-dev] Bug in compressed sniffer file decode

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 3 Sep 2003 17:41:58 -0700

On Wednesday, September 3, 2003, at 5:32 PM, Guy Harris wrote:


Or perhaps:

	1) they're not putting in valid CRCs;

	2) they don't check the CRCs;

	3) neither does WinZip;

	4) gunzip, zlib, and Stuffit Expander do, however.


If I do

	gzcat Snif6.caz >snif6.cap
	gzip < snif6.cap > snif6.cap.gz
	cmp -l Snif6.caz snif6.cap.gz

it reports:

     5   0 252
     6   0 211
     7   0 126
     8   0  77
    10  13   3
  8550 253 243
  8551  10 364
  8552 270 174
  8553 317 150
Bytes 5, 6, 7, and 8 are probably the last modified time, and byte 10 is probably the OS on which the compression was done: 

	{machine}% file Snif6.caz snif6.cap.gz
Snif6.caz: gzip compressed data, deflated, last modified: Wed Dec 31 16:00:00 1969, os: Win/32 snif6.cap.gz: gzip compressed data, deflated, last modified: Wed Sep 3 17:33:15 2003, os: Unix 

Perhaps bytes 8550 through 8553 are a CRC-32?