Ethereal-dev: Re: [ethereal-dev] MS Netmon 2.x trace which gives "corrupt file" when loaded

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <guy@xxxxxxxxxx>
Date: Wed, 22 Mar 2000 13:46:24 -0800 (PST)
> I also get errors when I unpack those files:
> 
> gzip: netmon.txt.gz: invalid compressed data--crc error
> gzip: VRU.CAP.gz: invalid compressed data--format violated

Bizarre - it appeared to have survived the mail path to my home ISP, at
least; I'll have to check whether the copy I received at work was also
ungzippable.

> Would be glad to look at them, as I was the one who provided the info on the
> NETMON 2.x format in the first place.

It turns out that those captures did not always have packet N+1 start at
the next byte following packet N (the glitches were, as I remember, on
32K boundaries, as per your hypothesis about the way NetMon 2 does
captures); I checked in a change to the NetMon file reader to read the
entire frame table and use the offsets in the frame table to find the
frames, and it allowed him to read the file.