Ethereal-users: Re: [Ethereal-users] any way to exceed the file size limit?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: LEGO <luis.ontanon@xxxxxxxxx>
Date: Tue, 14 Mar 2006 23:56:12 +0100
On 3/14/06, George P Nychis <gnychis@xxxxxxx> wrote:
> Hi,
>
> I was wondering if there is any way to exceed the libpcap file size limit?  Why is there a limit btw?

Pcap itself has no size limit, there's a 64K per packet limit but no
limit in the number of packets in the file.

The limit AFAIK is in the OS file_seek functions that may not allow to
access files bigger than a certain size (2GB), that's an OS limit
inherited by programs that run onm a certain platform.

ANSI C's fseek() uses a long for offset... so if you use fseek to
navigate a the file you'll be able to index to at most the maximum
value a long can take on a given platform.

wiretap uses long as well as index so the maximum size a seekable file
can have is what you can express with a long on a given system.

L.
--
This information is top security. When you have read it, destroy yourself.
-- Marshall McLuhan