Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] Editcap 100 argument limitation?

From: Jeff Morriss <jeff.morriss@xxxxxxxxxxx>
Date: Wed, 20 Jun 2007 16:06:25 -0400


Stephen Fisher wrote:
On Tue, Jun 19, 2007 at 04:48:15PM -0400, Rob Campbell wrote:

I did some experimenting and the problem seems to lie in that editcap seems to only read the first 100 arguments (be it individual packet numbers or sets of packet numbers).

Is this limit intentional or can it be removed? Is this a unix/linux limitation?

This is an arbitrary limit compiled into the editcap program:

Line 109 of editcap.c:

  static struct select_item selectfrm[100];

How many arguments do you need to pass to editcap? We could look into changing this limit or removing it entirely to make it dynamically allocate space for as many arguments as fit on the command-line.

I went ahead and (in rev 22145) increased the size of the array (up to 512). If that's not enough we can always go to a dynamically sized array, but that seems like overkill to me (now).

More importantly, I also made 'editcap' tell you when it runs out of room for packet selections.