Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 10111] "Limit each packet to" GUI element is misleading

[bugzilla-daemon@xxxxxxxxxxxxx]

Comment # 1 on bug 10111 from Guy Harris

*Some* upper limit is required by `pcap_open_live()`, as the upper limit is one
of the arguments, and, even if you have `pcap_create()` and `pcap_activate()`,
so that you don't need to specify an upper limit, something needs to be
recorded as the "snapshot length" for the pcap file or the pcap-ng Interface
Description Block.

In theory, 0 could be used as "no upper limit" in the file, but there's code
that reads pcap and pcap-ng files and that naively allocate a buffer based on
that size.  A very large value (2^31-1 or 2^32-1) could also be used, but said
naive code would run out of memory on 32-bit platforms in that case, and would
probably waste a huge chunk of address on 64-bit platforms.

So we might have to impose *some* limit in the "no limit" case.  The question
is whether eliminating the "no limit" option would make the UI better or worse;
it's not clear to me that eliminating the option would be an improvement, as
the default case for most users is probably "limit?  What's all this about a
limit?", and making them think about a limit at all might confuse them (which,
if they think "hey, this is Ethernet, the limit is 1500 bytes, right?", would
be a bad thing).

---

      You are receiving this mail because:

• You are watching all bug changes.