Wireshark · Ethereal-dev: Re: [Ethereal-dev] Bug in compressed sniffer file decode

[Gilbert Ramirez <gram@xxxxxxxxxxxxxxx>]

On Tue, 2003-09-02 at 18:16, Guy Harris wrote:
> 
> On Tuesday, September 2, 2003, at 4:03 PM, Greg Morris wrote:
> 
> > When attempting to decode a NAI Sniffer file CAZ.
> 
> ".caz" files are, allegedly, just gzipped ".cap" files (or, rather, 
> ".cap" files compressed using gzip format; I don't know whether they're 
> using gzip code).
> 
> However, if I rename that file to "snif6.cap.gz", and try to gunzip it, 
> I get
> 
> 	gunzip: snif6.cap.gz: invalid compressed data--crc error
> 

If you do this:

gzip -dc < Snif6.caz > Snif6.cap

then load Snif6.cap in ethereal, all 250 packets appear to be there,
*and* match the dissection of Snif6.caz (before it goes bad, that is).

--gilbert