On Thu, 24 Feb 2005 00:17:41 -0800, Dag Bakke <dag@xxxxxxxxx> wrote:
I am one of the lucky few who get the infamous
pcap: File has 4294949296-byte packet, bigger than maximum of 65535
error dialog when capturing files with Ethereal. This is with:
--------------------
Version 0.10.9 (C) 1998-2004 Gerald Combs <gerald@xxxxxxxxxxxx>
Compiled with GTK+ 2.6.2, with GLib 2.6.2, with libpcap 0.8.3, with libz 1.2.2,
with libpcre 5.0, with Net-SNMP 5.2.1, without ADNS.
Running with libpcap version 0.8.3 on Linux 2.6.11-rc3.
------------------------
I noticed that this error goes away if I check (enable) 'Update list of packets in real time'.
This appears to be 100% reproduceable.
I'll rebuild some stuff and see if it starts behaving. Will even try --without-zlib as mentioned in
http://www.ethereal.com/lists/ethereal-users/200412/msg00216.html
If anyone got a suggestion, I am all ears....
Dag B
___
LEGO wrote:
You could try one of the latest builds form the buildbots-builds/
directory in the download page to see if the problem has been solved
already.
If it hasn't and If there isn't sensitive data in the file and the
file is not huge, you might want to send the capture file that causes
the problem to the list. That way we can analyze the problem.
It happens with live capture. Every time. When compiled with zlib-support.
Unless 'Update list of packets in real time' is enabled.
And it only happens when the capture ends, and the application is about
to display the captured packets.
The attached file is a 2-frame capture exhibiting the problem.
Dag B
Attachment:
ethereal-zlibbug
Description: Binary data