Wireshark · Ethereal-dev: Re: [Ethereal-dev] Bug in compressed sniffer file decode

[Guy Harris <guy@xxxxxxxxxxxx>]

On Wednesday, September 3, 2003, at 5:32 PM, Guy Harris wrote:

> Or perhaps:
>
> 	1) they're not putting in valid CRCs;
>
> 	2) they don't check the CRCs;
>
> 	3) neither does WinZip;
>
> 	4) gunzip, zlib, and Stuffit Expander do, however.

If I do

	gzcat Snif6.caz >snif6.cap
	gzip < snif6.cap > snif6.cap.gz
	cmp -l Snif6.caz snif6.cap.gz

it reports:

     5   0 252
     6   0 211
     7   0 126
     8   0  77
    10  13   3
  8550 253 243
  8551  10 364
  8552 270 174
  8553 317 150

Bytes 5, 6, 7, and 8 are probably the last modified time, and byte 10 
is probably the OS on which the compression was done:

	{machine}% file Snif6.caz snif6.cap.gz
	Snif6.caz:    gzip compressed data, deflated, last modified: Wed Dec 
31 16:00:00 1969, os: Win/32
	snif6.cap.gz: gzip compressed data, deflated, last modified: Wed Sep  
3 17:33:15 2003, os: Unix

Perhaps bytes 8550 through 8553 are a CRC-32?