Wireshark-users: Re: [Wireshark-users] Can't use Wireshark with a smbfs mount
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Mon, 5 Jul 2010 11:03:45 -0700
On Jul 5, 2010, at 9:15 AM, Jeanne Clément wrote:

> I’ve build a test platform with Linux Ubuntu and I want to capture and store pcap file directly to another server (Win7 64bits).
> I’ve installed the smbfs 2:3.4.0-3ubuntu5.6 package and mounted the share on /mnt/trace
> mount -t smbfs //10.35.10.223/trace /mnt/trace -o workgroup=WORKGROUP,username=admin
> Then I’m able to write a file in my share both from shell (mkdir test) and from a gnome app (gedit), but not from Wireshark. I got the message: The file “/mnt/trace/test/pcap” could not be opened: Value to big for defined datatype.

Does this happen only with files on an SMB server?  If so, it's probably that smbfs is not properly performing the checks for files >= 2GB in size, and rejecting non-O_LARGEFILE opens or seeks even if the file is < 2GB in size.

Can you use cifsfs instead?