Wireshark · Ethereal-users: [Ethereal-users] pcap: File has 4294949296-byte packet, bigger than maximum of 65535

[Stephen Youndt <syoundt@xxxxxxxxxxxxxxxxxxx>]

Forgive me if this is documented somewhere, but I've been googling for a 
couple of days without finding anything applicable.

I get the above mentioned message whenever I try to open a tcpdump 
capture file on SPARC Solaris hosted ethereal.  The files open without 
any problem in windows and linux, so it's not file corruption. In fact, 
the same files work with tcpdump on the SPARC box. A similar message (a 
different numeral) is displayed if I try to save a capture from within 
ethereal even though the capture seems to work.

I can capture valid files with tethereal, but can't read them back with 
[t]ethereal on SPARC. They work fine on x86 systems, though, and within 
tcpdump on SPARC.

I've tried a couple different versions of Ethereal and libpcap including 
direct downloads from SunFreeware, so my software build skills aren't 
the common variable.

I suspect an alignment or endian problem, but I don't have enough 
experience with the source to even begin to debug it.

Has anybody else seen this, and perhaps have a workaround or patch?

Thanks in advance,
Stephen

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature