Wireshark-bugs: [Wireshark-bugs] [Bug 3895] Save-As Nokia tcpdump corrupts the file
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Sun, 16 Aug 2009 15:55:35 -0700 (PDT)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3895





--- Comment #1 from Geoff Hart <geoffreyhart@xxxxxxxxxxxx>  2009-08-16 15:55:33 PDT ---
Two additional comments:
1) This only happens when you save a subset of the packets; it works fine when
you select 'All Packets/Captured', it corrupts the file when you select 'All
Packets/Displayed'; even when all packets are displayed.

2) Comparing the output of the above two cases for a 'good' and a 'corrupted'
output, the only difference in the output is that the 4-byte Nokia IPSO 'junk'
at the end of each frame header is preserved in 'All Packets/Captured' and
zeroed out in 'All Packets/Displayed'. Looking at libpcap.c, this 'junk'
doesn't appear to be read by Wireshark, but when it zeroes it out, Wireshark
can no longer read the file.


-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.