Wireshark-bugs: [Wireshark-bugs] [Bug 10037] Pcap-ng PB/EPB with caplen > len shouldn't be treat
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Fri, 25 Apr 2014 18:14:42 +0000

changed bug 10037

What Removed Added
Status CONFIRMED RESOLVED
Component Wireshark Capture file support (libwiretap)
Hardware x86 All
Resolution --- FIXED
Summary Dumpcap recognizes error where wireshark does not Pcap-ng PB/EPB with caplen > len shouldn't be treated as an error
OS Ubuntu All

Comment # 7 on bug 10037 from 
The code to read pcap files doesn't consider caplen > len an error; the code to
read pcap-ng files does.  dumpcap captures a pcap file from the pipe and writes
a pcap-ng file; Wireshark/TShark try to read that file and they report an
error.

There's no reason to treat that as an error - we can just work around it. 
(tcpdump, at least, doesn't treat it as an error; libpcap just passes the
lengths through for both pcap 2.4 and later and for pcap-ng.)

Fixed in:

    the trunk - I41fbcf54341ea0429cef875442ea1f1377177a5f

    1.10 branch - If8fe0c21ff4a3a57fbd0575d43306fa892d31a6a

    1.8 branch - I28908674d5a6ee4bb76e01cd4c7b463fa9d155f6

You are receiving this mail because:
  • You are watching all bug changes.