Hello Sir,
Please tell me Is there any limitation on size of the captured file we
are opening in ethereal?
Regards
Harsha
----- Original Message -----
From: "Guy Harris" <gharris@xxxxxxxxx>
To: "Ethereal development" <ethereal-dev@xxxxxxxxxxxx>
Sent: Friday, January 28, 2005 4:55 PM
Subject: Re: [Ethereal-dev] Regarding Memory allocation
> harshas wrote:
>
> > If the number of messages in the file is more(say more than 1000) than
> > ethereal
> > exits with seg fault.(I am using LINUX machine).
> > 1. I feel LINUX machine somewhere fails to allocate such an ammount of
> > memory to the process in which ethereal is runing? is it so?
>
> I suppose it's possble, but I've read captures with *many* more packets
> than 1000.
>
> > 2. Do you feel it is the problem with my code?(It works upto 500
messages).
>
> It's possible that there's a bug somewhere in your code (and it's
> possible that the bug has nothing to do with the number of packets in
> your capture). Try running it under gdb and see what the stack trace is
> when it crashes with the segmentation fault.
>
> > 3. Sir I want to know why reassembly is done
>
> So that a packet that's fragmented across more than one link-layer
> packet (IP fragmentation, splitting a packet across two or more TCP
> segments, etc.) can be fully dissected.
>
> > and what happens during reassembling.?
>
> The data from all of the fragments is collected and combined into a
> buffer in memory and saved. When dissecting the last link-layer packet,
> a new tvbuff is constructed that refers to the reassembled data, and
> that's what's used to dissect the higher-level packet of which the
> link-layer packet is the last component.
>
> _______________________________________________
> Ethereal-dev mailing list
> Ethereal-dev@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-dev
>