Wireshark · Wireshark-dev: Re: [Wireshark-dev] Packet Size limited during capture message

[Bill Meier <wmeier@xxxxxxxxxxx>]

Brian Oleksa wrote:
> Guy
>
> The 70% that I can load has a bunch of helen packets in it and every one 
> of the helen packets has the
> "Packet size limited during capture" message. Even the very first helen 
> packet.
>
> I do not believe that one packet relies on one another. A packet is just 
> a packet.
>
> I will have to use the debugger to dig deeper into this one.
>
> Thanks,
> Brian

The standard way I approach this type of situation is to first use
editcap -r m-n   (where m & n are frame numbers) repeatedly to extract a 
portion of the capture file and then see if I get a crash with that portion.

In effect, I do a kind of binary search to get the minimum  number of 
frames (hopefully one frame) in the capture file to cause a crash.

(This is easier if the crash occurs with tshark).