Ethereal-users: Re: [Ethereal-users] corrupt capture files on freebsd 4.8

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "jim feldman" <jmf@xxxxxxxxxxxxx>
Date: Fri, 25 Jul 2003 09:42:18 -0600

Date: Thu, 24 Jul 2003 17:55:11 -0700
From: Guy Harris <guy@xxxxxxxxxxxx>
Subject: Re: [Ethereal-users] corrupt capture files on freebsd 4.8
On Thursday, July 24, 2003, at 2:52 PM, jim feldman wrote:
I can't seem to save my capture files in libpcap format. It always complains they're corrupt. If I try and load the saved file, I get this from the command line. Message: pcap: File has 103809088-byte packet, bigger than maximum of 65535

What happens if you try to read the saved file with tcpdump?
Thats when I get the above message. When I try and read one of the capture files from the ethereal sample area, it core dumps. I saw an old reference (in the ethereal archives) to problems on netbsd and zlib and defining z_off_t. I hacked the makefile to pass without-zlib to configure, and the resulting image works fine. Going from there, I checked and found my zconf.h was different in /usr/include and /usr/local/include. Wasn't the issue that defining z_off_t as a long was "wrong" for ethereal? When we get to the bottom of this, I'll copy the ports maintainer to make the appropriate hacks.
thanks
jim
# for k in `locate zconf.h`
do
ls $k
grep z_off_t $k
done
/usr/include/zconf.h
#define z_off_t long
/usr/local/include/zconf.h
#  define z_off_t  off_t
#ifndef z_off_t
#  define  z_off_t long
/usr/obj/usr/src/i386/usr/include/zconf.h
#define z_off_t long
/usr/src/lib/libz/zconf.h
#define z_off_t long