Wireshark-bugs: [Wireshark-bugs] [Bug 12884] sshdump only captures a few packets
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: bugzilla-daemon@xxxxxxxxxxxxx
Date: Tue, 13 Sep 2016 13:28:35 +0000

Comment # 12 on bug 12884 from 
Adding the modifications to disable g_debug, I got the output:

   
E:\Wireshark\build64\run\RelWithDebInfo\extcap\sshdump.exe--extcap-interfacessh--capture--remote-hostssh-host--remote-usernamegraham--remote-passwordXXXXXXXXXXXX--remote-interfaceeth0--remote-capture-bintcpdump--fifoc:\temp\sshdump--debugRunning:
'tcpdump' -i 'eth0' -w - -f 'not ((host fe80::5efe:a00:20f or host 10.0.2.15 or
host fe80::48cf:f21:d2b2:b88c) and port 22)'

After stopping the process I now get a pcap file in the --fifo location, but it
is corrupt, similar in a manner reported by the gui:

    .\capinfos.exe C:\temp\sshdump
capinfos: An error occurred after reading 1 packets from "C:\temp\sshdump": The
file appears to be damaged or corrupt.
(pcap: File has 3932171-byte packet, bigger than maximum of 262144)

You are receiving this mail because:
  • You are watching all bug changes.