Wireshark · Ethereal-users: Re: [Ethereal-users] Capture File Limitation

[Guy Harris <guy@xxxxxxxxxx>]

> Does tethereal place limitations on the size of a capture file ?

As Tethereal uses the standard I/O library to read capture files, the
standard I/O library routines may impose such a limitation; if "fread()"
or "fwrite()", or "read()" and "write()", don't work past, say, a 2GB
boundary, then Tethereal won't be able to write capture files > 2GB.

> Running RH7.1, no file system limitations on largefiles.

Unless you're running on a 64-bit platform, I wouldn't say that there
are *no* system limitations on large files; on platforms with 32-bit
"long"s, neither "fseek()" nor "lseek()" can go past 2GB, for example.

I don't know whether Linux kernels with large file support require, for
example, that a file be opened with O_LARGEFILE in order to allow it to
go past 2GB on platforms where "off_t" is 32 bits.  If it does, then
Tethereal, as it just uses "fopen()" to open capture files, will not be
able to do so if "fopen()" doesn't itself use O_LARGEFILE (and I suspect
it doesn't).