Wireshark · Ethereal-dev: Re: [ethereal-dev] Ethereal on Solaris -- lexical scanner problem s.

[Guy Harris <guy@xxxxxxxxxx>]

> so it looks as if we wrote it out wrong somehow (odd, given that we're
> using "libpcap", not "wiretap", to write out capture files).

The file looks fairly borked - the first packet claims to have 96 bytes
of data, and it does, but the second packet also claims to have 96 bytes
of data, and, instead of the packet header showing up after 96 bytes of
data, there appears to be more "beefbad" stuff.

There *does* appear to be a valid packet header further into the file...

...at the right offset, were one to insert a "libpcap" packet header
into the file after the 96 data bytes of the second packet.

I.e., it looks as if 16 bytes of "libpcap" packet header failed to get
written to the data stream.  Bizarre....