Ethereal-dev: Re: [ethereal-dev] RE: Correct sniffdecomp.c attached

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Gilbert Ramirez <gram@xxxxxxxxxx>
Date: Mon, 22 May 2000 10:09:58 -0500
On Mon, May 22, 2000 at 02:17:36AM -0500, Guy Harris wrote:
> 
> 
> On Sat, May 20, 2000 at 04:05:02AM -0700, Guy Harris wrote:
> > It still needs some cleanup, e.g. freeing the buffer allocated for
> > decompression in the initial sequential pass through the file when we
> > close the sequential side in "wtap_sequential_close()", and it may be
> > possible to implement some backward seeks by moving the pointer in the
> > decompressed-data buffer backward, rather than doing a zlib-style seek
> > back to the beginning of the compressed part of the file and skipping
> > forward.
> 
> And here's a patch that takes care of those issues; this is, as were the
> previous two patches, patches against the current CVS tree.
> 
> I don't know whether all compressed Sniffer files have non-compressed
> type 7 and type 6 records at the beginning, so this may fail on
> some compressed Sniffer files; let me know if it does - we may have to
> look at some stuff in the version record to figure out whether a
> compressed file has uncompressed records after the version record.

It works on some token-ring traces I have.  'file' v3.26 on Linux
reports the file as:

Sniffer capture file - version 5.50 (Format 2, Token ring)

--gilbert