Wireshark-dev: Re: [Wireshark-dev] Packet Size limited during capture message

From: Bill Meier <wmeier@xxxxxxxxxxx>
Date: Tue, 23 Mar 2010 22:14:32 -0400
Brian Oleksa wrote:
Guy

The 70% that I can load has a bunch of helen packets in it and every one of the helen packets has the "Packet size limited during capture" message. Even the very first helen packet.

I do not believe that one packet relies on one another. A packet is just a packet.

I will have to use the debugger to dig deeper into this one.

Thanks,
Brian



The standard way I approach this type of situation is to first use
editcap -r m-n (where m & n are frame numbers) repeatedly to extract a portion of the capture file and then see if I get a crash with that portion.

In effect, I do a kind of binary search to get the minimum number of frames (hopefully one frame) in the capture file to cause a crash.

(This is easier if the crash occurs with tshark).