Wireshark · Wireshark-bugs: [Wireshark-bugs] [Bug 9390] Failure reading a pcap-ng file and writing a pcap file from it

[bugzilla-daemon@xxxxxxxxxxxxx]

Comment # 6 on bug 9390 from Guy Harris

That error is WTAP_ERR_BAD_FILE; the problem is that the packet in question has
an on-the-wire length of 98432, which is bigger than 65535, and the 1.10 and
earlier versions of the code that writes out pcap packets treats that as an
error.  The code on the trunk only treats a *captured data length* > 65535 as
an error.

The check for the on-the-wire length really doesn't serve much of a purpose, so
we should probably remove it; libpcap, although it rejects a *captured* length
> 65535, doesn't care about the *on-the-wire* length.

(Presumably this capture came from a device doing segmentation or reassembly
offloading; 98432 bytes is a bit big even for a jumbo Ethernet packet.  Perhaps
libpcap and Wireshark should increase the maximum size to 128K or something
such as that.)

---

      You are receiving this mail because:

• You are watching all bug changes.