Wireshark-dev: Re: [Wireshark-dev] pcap with packet size >64k ?
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: warlord <warlord@xxxxxxxxxxx>
Date: Tue, 08 Jan 2008 08:46:40 +0100
Good idea Ulf. I attached a small pcap which includes a hostname request sent to the nameserver. As I took the liberty to hexedit the IP addresses the checksum is wrong, but that doesn't matter.
The two size fields in the pcap are 32 bits each, claiming the packet size was 4b 00 01 00(0x0001004b), which is 65611. When wireshark loads this pcap it complains about a packet size >65535. 

wrl

Ulf Lamping wrote:

warlord schrieb:

-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160

Nope that was not the one :/

Hi!
Might be a good idea to send a small (compressed) sample capture file to this list so someone can have a try ... 

Regards, ULFL




--
dreaming in digital - living in realtime - thinking in binary - talking in IP - welcome to our world

Attachment: test2.pcap
Description: Binary data

Attachment: signature.asc
Description: OpenPGP digital signature