https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=3895
--- Comment #1 from Geoff Hart <geoffreyhart@xxxxxxxxxxxx> 2009-08-16 15:55:33 PDT ---
Two additional comments:
1) This only happens when you save a subset of the packets; it works fine when
you select 'All Packets/Captured', it corrupts the file when you select 'All
Packets/Displayed'; even when all packets are displayed.
2) Comparing the output of the above two cases for a 'good' and a 'corrupted'
output, the only difference in the output is that the 4-byte Nokia IPSO 'junk'
at the end of each frame header is preserved in 'All Packets/Captured' and
zeroed out in 'All Packets/Displayed'. Looking at libpcap.c, this 'junk'
doesn't appear to be read by Wireshark, but when it zeroes it out, Wireshark
can no longer read the file.
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.
