Wireshark-bugs: [Wireshark-bugs] [Bug 11162] pcap-ng file appears to be damaged or corrupt
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Wed, 29 Apr 2015 17:35:17 +0000

changed bug 11162


What Removed Added
Status INCOMPLETE RESOLVED
Resolution --- NOTABUG

Comment # 5 on bug 11162 from 
$ bc
bc 1.06
Copyright 1991-1994, 1997, 1998, 2000 Free Software Foundation, Inc.
This is free software with ABSOLUTELY NO WARRANTY.
For details type `warranty'. 
obase=16
33555980
200060C
1548
60C

Looks like whatever program wrote that file set a bit that it shouldn't have in
the ending block length field.

I suggest you tell whoever's teaching the class that the file isn't valid, so
that they can get the file, and the program that wrote it, fixed.

(If they disagree that it's invalid, point them to

    https://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html#sectionblock

where it clearly gives the same description for *both* instances of the block
length field as a 32-bit length value and says of the second instance that
"This field is duplicated for permitting backward file navigation.".)

You are receiving this mail because:
  • You are watching all bug changes.