Wireshark · Wireshark-users: Re: [Wireshark-users] Editcap 100 argument limitation?

[Jeff Morriss <jeff.morriss@xxxxxxxxxxx>]

Stephen Fisher wrote:
> On Tue, Jun 19, 2007 at 04:48:15PM -0400, Rob Campbell wrote:
>
> > I did some experimenting and the problem seems to lie in that editcap 
> > seems to only read the first 100 arguments (be it individual packet 
> > numbers or sets of packet numbers).
> >
> > Is this limit intentional or can it be removed?  Is this a unix/linux 
> > limitation?
>
> This is an arbitrary limit compiled into the editcap program:
>
> Line 109 of editcap.c:
>
>   static struct select_item selectfrm[100];
>
> How many arguments do you need to pass to editcap?  We could look into 
> changing this limit or removing it entirely to make it dynamically 
> allocate space for as many arguments as fit on the command-line.

I went ahead and (in rev 22145) increased the size of the array (up to 
512).  If that's not enough we can always go to a dynamically sized 
array, but that seems like overkill to me (now).

More importantly, I also made 'editcap' tell you when it runs out of 
room for packet selections.