Ethereal-dev: [Ethereal-dev] Recent changes (November 2005) in wiretap breaking pcap support?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: "Jean-Baptiste Marchand (lists)" <jbm.lists@xxxxxxxxx>
Date: Sun, 13 Nov 2005 12:42:28 +0100
Hello,

updating my svn tree and recompiling ethereal, I've noticed that
ethereal on MacOS X 10.4.3 can no longer open my pcap files.

The error message is:

The capture file appears to be damaged or corrupt.
(pcap: File has 1131706059-byte packet, bigger than maximum of 65535)

The huge size changes depending on the capture I try to open but it is
always huge.

Reading the same captures with tcpdump -nr myfile.cap works fine.

I suspect that recent changes in wiretap might by the cause of the
problem. Is it possible that it would be an endianess issue (the test
system is a PowerPC G3)?

Thanks,

Jean-Baptiste Marchand