Wireshark · Wireshark-dev: Re: [Wireshark-dev] Packet Size limited during capture message

[Brian Oleksa <oleksab@xxxxxxxxxxxxxxxxxxxxxx>]

Bill

Can you collaborate on this a little more..??

Do I want to pass in my .pcap file as the <infile> to which I am having 
problems with..??

And I am assuming that you want me to pass in the "ballpark" number (or 
a range) to where I think the crash occurs.

I can load about 70% of the file...which is right around frame # 16813.....

For example:  C:\wireshark\editcap test.pcap -r 16813-20000     is this 
what you do..??

Thanks,
Brian



Bill Meier wrote:
> Brian Oleksa wrote:
>   
> > Guy
> >
> > The 70% that I can load has a bunch of helen packets in it and every one 
> > of the helen packets has the
> > "Packet size limited during capture" message. Even the very first helen 
> > packet.
> >
> > I do not believe that one packet relies on one another. A packet is just 
> > a packet.
> >
> > I will have to use the debugger to dig deeper into this one.
> >
> > Thanks,
> > Brian
> >
> >
> >     
>
> The standard way I approach this type of situation is to first use
> editcap -r m-n   (where m & n are frame numbers) repeatedly to extract a 
> portion of the capture file and then see if I get a crash with that portion.
>
> In effect, I do a kind of binary search to get the minimum  number of 
> frames (hopefully one frame) in the capture file to cause a crash.
>
> (This is easier if the crash occurs with tshark).
>
>
>
> ___________________________________________________________________________
> Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
> Archives:    http://www.wireshark.org/lists/wireshark-dev
> Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
>              mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe
>