>On Jul 5, 2010, at 9:15 AM, Jeanne Cl?ment wrote:
>
>> I?ve build a test platform with Linux Ubuntu and I want to capture and store pcap file directly to another
server (Win7 64bits).
>> I?ve installed the smbfs 2:3.4.0-3ubuntu5.6 package and mounted the
>> share on /mnt/trace mount -t smbfs //10.35.10.223/trace /mnt/trace -o
>> workgroup=WORKGROUP,username=admin
>> Then I?m able to write a file in my share both from shell (mkdir test) and from a gnome app (gedit),
but not from Wireshark. I got the message: The file ?/mnt/trace/test/pcap? could not be opened: Value to big for defined datatype.
>
>Does this happen only with files on an SMB server? If so, it's probably that smbfs is not properly performing
the checks for files >= 2GB in size, and >rejecting non-O_LARGEFILE opens or seeks even if the file is < 2GB in size.
>
>Can you use cifsfs instead?
This problem occurs only when Wireshark attempt to write on my smb mountpoint whatever the file size. With cifs, the problem is exactly
the same.
/mnt/trace mount -t cifs //10.35.10.223/trace /mnt/trace -o workgroup=WORKGROUP,username=admin
This is not blocking to me because I’m using dumpcap, but I’ll investigate later