Wireshark · Ethereal-dev: Re: [Ethereal-dev] Bug in compressed sniffer file decode

[John McDermott <jjm@xxxxxxxxxx>]

I found this http://sources.redhat.com/ml/ecos-patches/2002-09/msg00018.html
It may relate to the problem.

I got this info on Snif6.caz using gzip on win32:
C:\John\work>\john\gzip\gzip -l --verbose Snif6.caz
method  crc     date  time  compressed  uncompr. ratio uncompressed_name
defla cfb808ab Sep 05 15:31      8557     71587  88.0% Snif6.caz

Then I copied it to Snif6.gz and tried to gunzip it:

C:\John\work>\john\gzip\gzip -d Snif6a.gz
gzip: Snif6a.gz: invalid compressed data--crc error

(gzip -t gives the same result)

I have gzip 1.2.4 downloaded today from gzip.org.

I don't have a linux box up today to test it, but it seems the CRC is 
confused (or gzip is).


--john

Greg Morris wrote:
> Well,
>  
> I did the gzip and then rename of the original cap file to caz...
>  
> Ethereal works great with the file... But if I try to open the newly 
> created caz file with Sniffer, it crashes. So apparently they are doing 
> something other then just a gzip of the file.
>  


--
John McDermott
Writer, Educator, Consultant
jjm@xxxxxxxxxx		http://www.jkintl.com
V +1 505/377-6293 F +1 505/377-6313