Date: Thu, 24 Jul 2003 17:55:11 -0700
From: Guy Harris <guy@xxxxxxxxxxxx>
Subject: Re: [Ethereal-users] corrupt capture files on freebsd 4.8
On Thursday, July 24, 2003, at 2:52 PM, jim feldman wrote:
I can't seem to save my capture files in libpcap format. It always
complains they're corrupt. If I try and load the saved file, I get
this from the command line.
Message: pcap: File has 103809088-byte packet, bigger than maximum of
65535
What happens if you try to read the saved file with tcpdump?
Thats when I get the above message. When I try and read one of the capture
files from the ethereal sample area, it core dumps.
I saw an old reference (in the ethereal archives) to problems on netbsd and
zlib and defining z_off_t. I hacked the makefile to pass without-zlib to
configure, and the resulting image works fine. Going from there, I checked
and found my zconf.h was different in /usr/include and /usr/local/include.
Wasn't the issue that defining z_off_t as a long was "wrong" for ethereal?
When we get to the bottom of this, I'll copy the ports maintainer to make
the appropriate hacks.
thanks
jim
# for k in `locate zconf.h`
do
ls $k
grep z_off_t $k
done
/usr/include/zconf.h
#define z_off_t long
/usr/local/include/zconf.h
# define z_off_t off_t
#ifndef z_off_t
# define z_off_t long
/usr/obj/usr/src/i386/usr/include/zconf.h
#define z_off_t long
/usr/src/lib/libz/zconf.h
#define z_off_t long