Wireshark-bugs: [Wireshark-bugs] [Bug 8317] pcap-ng: name resolution block is not written to fil
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Thu, 28 Mar 2013 02:48:10 +0000

Comment # 6 on bug 8317 from 
(In reply to comment #5)
> I tried again today and found something strange: if I capture packets with
> Wireshark and then save them to disk, there will not be a NRB in the
> resulting pcapng file (technically I think it means saving the file to a
> different name than the temporary one dumpcap used when initially creating
> it). Wireshark showed name resolutions while displaying the packets though.
> 
> If I then add a comment to the file and save it *again*, there suddenly IS a
> NRB in the file now. Can someone verify?

I think I understand what's going on now. If all of the following are true:
- it's the result of a live capture
- there are no comments
- the format is pcap-ng

then rather than reprocessing everything we just copy the 'temporary' capture
file to the new name. However, the temp capture file has no NRBs, which is the
cause of this issue.

So, the fix is not to take the shortcut if name resolution is enabled, I think.

You are receiving this mail because:
  • You are watching all bug changes.