Message: 2
Date: Wed, 20 Jun 2007 16:06:25 -0400
From: Jeff Morriss <jeff.morriss@xxxxxxxxxxx>
Subject: Re: [Wireshark-users] Editcap 100 argument limitation?
To: Community support list for Wireshark
<wireshark-users@xxxxxxxxxxxxx>
Message-ID: <467988C1.7030803@xxxxxxxxxxx>
Content-Type: text/plain; charset=UTF-8; format=flowed
Stephen Fisher wrote:
> On Tue, Jun 19, 2007 at 04:48:15PM -0400, Rob Campbell wrote:
>
>> I did some experimenting and the problem seems to lie in that editcap
>> seems to only read the first 100 arguments (be it individual packet
>> numbers or sets of packet numbers).
>>
>> Is this limit intentional or can it be removed? Is this a unix/linux
>> limitation?
>
> This is an arbitrary limit compiled into the editcap program:
>
> Line 109 of editcap.c:
>
> static struct select_item selectfrm[100];
>
> How many arguments do you need to pass to editcap? We could look into
> changing this limit or removing it entirely to make it dynamically
> allocate space for as many arguments as fit on the command-line.
I went ahead and (in rev 22145) increased the size of the array (up to
512). If that's not enough we can always go to a dynamically sized
array, but that seems like overkill to me (now).
More importantly, I also made 'editcap' tell you when it runs out of
room for packet selections.
Thanks Jeff! 512 should be tons. I was unaware of the ability to
use tethereal/tshark to read in from one pcap and output to a
different file using a wireshark display filter.
I was using tethereal to dump the pcaps to XML/Text and then parsing
the XML/Text files collecting all of the packet numbers that belonged
to a flow based on IP/Port information, and then using regular
expressions I was creating the sets of packet numbers to allow me for
than 100 packets. Everything was done using tcl scripts so it's not
like I was manually entering 100 arguments or anything, but the silent
failure when it hit the 100 argument mark took me a little while to
figure out :)
Had I have known that tethereal could do it for me by just passing
it the IP/Port information as a filter than I likely would never have
needed this, but reporting that it hit the limit is definately a great
improvement as I'm sure someone will hit this again.
Thanks again,
Rob
---------------------------------------
Rob Campbell
a.robcampbell@xxxxxxxxx
