ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Ethereal-dev: Re: [Ethereal-dev] Bug in compressed sniffer file decode

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Martin Regner" <martin.regner@xxxxxxxxx>
Date: Wed, 3 Sep 2003 06:29:07 +0200
Guy Harris wrote:

>
>On Tuesday, September 2, 2003, at 4:16 PM, Guy Harris wrote:
>
>> 3) there's a problem both with the gunzip on my machine and with the 
>> zlib on my machine.
>
>...and with Stuffit expander on my machine, as if I try to have it 
>expand "snif6.cap.gz", it says "The archive may contain damaged 
>content".
>
>So I suspect 3) isn't the case; I don't know whether 1) or 2) is the 
>case.  (Try extracting "Snif6.caz" from the mail you sent to 
>ethereal-dev, or from the ethereal-dev archives, and see if a Sniffer 
>can read it.  If not, it somehow got corrupted; if so, ".caz" files 
>probably aren't just gzipped ".cap" files.)
>


If I opened the Snif6.caz and did as Greg wrote in his mail (filter+Reset) I got the same problem as him.

If I renamed the file to Snif6.cap.gz and extracted the Snif6.cap with WinZip (that didn't complain that the file is corrupted) and
opened the Snif6.cap file I got and then did as Greg wrote in his mail (filter+Reset) the file was correctly dissected even after filtering+Reset.