Ethereal-dev: Re: [ethereal-dev] Re: [ethereal-users] Ethereal crash reading tcpdump '-r' file

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <guy@xxxxxxxxxx>
Date: Wed, 13 Sep 2000 14:27:05 -0700 (PDT)
> Here's a diff against the current CVS, and it might actually apply
> cleanly against your 0.8.10, to guard against ethereal blowing up on
> the file. The capture file is indeed very different than what ethereal
> expects.

It's also different from what standard tcpdump expects:

	tooting$ tcpdump -r /u/guy/captures/barfolino.pcap 
	18:22:41.289231 8e:6:36:32:0:a0 1:d9:bf:bf:0:a0 8e06 294: 
	                         80aa 0800 4500 0118 0ce9 0000 4011 55e9
	                         0a01 0201 0a01 0101 01f4 01f4 0104 cf94
	                         fefa fee7 f500 0000 0000 0000 0000 0000
	                         0110 0200 0000 0000 0000 00fc 0d00 00cc
	                         0000 0001 0000 0001 0000 00c0 0001 0804
	                         fefa fee7 f500 0000 0300 002c 0001 0000
	                         8001 0005 8002 0002 8003 0002 8004 0001
	                         800b 0002 000c 0004 000f 4240 800b 0001
	                         800c 05dc 0300 002c 0101 0000 8001 0005
	                         8002 0001 8003 0002 8004 0001 800b 0002
	                         000c 0004 000f 4240 800b 0001 800c 05dc
	                         0300 002c 0201 0000 8001 0001 8002 0002
	                         8003 0002 8004 0001 800b 0002 000c 0004
	                         000f 4240 800b 0001 800c 05dc 0000 002c
	                         0301 0000 8001 0001 8002 0001 8003 0002
	                         8004 0001 800b 0002 000c 0004 000f 4240
	                         800b 0001 800c 05dc 0000 0014 0e58 d577
	                         4df6 0200 7d0b 0244
	tcpdump: pcap_loop: bogus savefile header

I'll have to try it at home, on my FreeBSD 3.4 machine, but FreeBSD
3.4's libpcap isn't, as I remember, significantly different from the
vanilla one.