Wireshark-bugs: [Wireshark-bugs] [Bug 11162] pcap-ng file appears to be damaged or corrupt
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Wed, 29 Apr 2015 17:46:13 +0000

Comment # 6 on bug 11162 from 
(In reply to Guy Harris from comment #5)
> $ bc
> bc 1.06
> Copyright 1991-1994, 1997, 1998, 2000 Free Software Foundation, Inc.
> This is free software with ABSOLUTELY NO WARRANTY.
> For details type `warranty'. 
> obase=16
> 33555980
> 200060C
> 1548
> 60C
> 
> Looks like whatever program wrote that file set a bit that it shouldn't have
> in the ending block length field.
> 
> I suggest you tell whoever's teaching the class that the file isn't valid,
> so that they can get the file, and the program that wrote it, fixed.
> 
> (If they disagree that it's invalid, point them to
> 
>     https://www.winpcap.org/ntar/draft/PCAP-DumpFileFormat.html#sectionblock
> 
> where it clearly gives the same description for *both* instances of the
> block length field as a 32-bit length value and says of the second instance
> that "This field is duplicated for permitting backward file navigation.".)

Thanks for your feedback. I will let them know.

Thanks!

You are receiving this mail because:
  • You are watching all bug changes.