Bill
Can you collaborate on this a little more..??
Do I want to pass in my .pcap file as the <infile> to which I am having
problems with..??
And I am assuming that you want me to pass in the "ballpark" number (or
a range) to where I think the crash occurs.
I can load about 70% of the file...which is right around frame # 16813.....
For example: C:\wireshark\editcap test.pcap -r 16813-20000 is this
what you do..??
Thanks,
Brian
Bill Meier wrote:
Brian Oleksa wrote:
Guy
The 70% that I can load has a bunch of helen packets in it and every one
of the helen packets has the
"Packet size limited during capture" message. Even the very first helen
packet.
I do not believe that one packet relies on one another. A packet is just
a packet.
I will have to use the debugger to dig deeper into this one.
Thanks,
Brian
The standard way I approach this type of situation is to first use
editcap -r m-n (where m & n are frame numbers) repeatedly to extract a
portion of the capture file and then see if I get a crash with that portion.
In effect, I do a kind of binary search to get the minimum number of
frames (hopefully one frame) in the capture file to cause a crash.
(This is easier if the crash occurs with tshark).
___________________________________________________________________________
Sent via: Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives: http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe