Wireshark · Ethereal-dev: RE: [ethereal-dev] Ethereal on Solaris -- lexical scanner problem s.

["Brown, Wes" <Wes_Brown@xxxxxxx>]

Where are the capture files stored?

There doesn't seem to be any intuitive locations.

Wes

-----Original Message-----
From: Guy Harris [mailto:guy@xxxxxxxxxx]
Sent: Friday, August 06, 1999 5:58 PM
To: Brown, Wes
Cc: 'Guy Harris'; Brown, Wes; 'Gilbert Ramirez'; 'ethereal-dev@xxxxxxxx'
Subject: Re: [ethereal-dev] Ethereal on Solaris -- lexical scanner
problem s.


> "print cf.count" gives me ...
> 
> "$1 = 2".
> 
> And truly, at this point, I don't recall how far along it went before
> it coredumped.

The fact that "cf.count" is only 2 suggests that it didn't get very far
at all - "count" starts out as zero, and gets bumped in
"wtap_dispatch_cb()" after reading a packet, which says that it's the
third packet on which it blew up.  That's actually a good sign, in a
perverse sense - it means that it can probably be reproduced with a
small bit chopped off the front of the capture file.

I can probably cook up a quick program to slice out the first N packets
of a "libpcap" capture, if such a program doesn't already exist
("tcpslice" slices by time stamp, not by packet count), so, if your
capture files aren't private, you could slice off the first 5 of them,
say, and, if the program still blows up on that one, send the resulting
capture file to one or more of us and we could take a look at it.