Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Ethereal-users: [Ethereal-users] pcap: File has 4294949296-byte packet, bigger than maximum of 6

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Stephen Youndt <syoundt@xxxxxxxxxxxxxxxxxxx>
Date: Wed, 15 Dec 2004 16:36:39 -0500
Forgive me if this is documented somewhere, but I've been googling for a couple of days without finding anything applicable.

I get the above mentioned message whenever I try to open a tcpdump capture file on SPARC Solaris hosted ethereal. The files open without any problem in windows and linux, so it's not file corruption. In fact, the same files work with tcpdump on the SPARC box. A similar message (a different numeral) is displayed if I try to save a capture from within ethereal even though the capture seems to work.

I can capture valid files with tethereal, but can't read them back with [t]ethereal on SPARC. They work fine on x86 systems, though, and within tcpdump on SPARC.

I've tried a couple different versions of Ethereal and libpcap including direct downloads from SunFreeware, so my software build skills aren't the common variable.

I suspect an alignment or endian problem, but I don't have enough experience with the source to even begin to debug it.

Has anybody else seen this, and perhaps have a workaround or patch?

Thanks in advance,
Stephen

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature