Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Ethereal-users: Re: [Ethereal-users] pcap: File has 4294949296-byte packet, bigger than maximum

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Stephen Youndt <syoundt@xxxxxxxxxxxxxxxxxxx>
Date: Thu, 16 Dec 2004 13:04:37 -0500
I just tried that and editcap gives me the same error.

Stef wrote:

Have you tried editcap
(http://www.ethereal.com/docs/man-pages/editcap.1.html), "forcing"
various option for output, using the "-F", then trying to open the
resultant file? I have had a similar problem, but in the opposite
direction: file captured with tcpdump (under Linux, if that matters at
all), which I had to analyze, but would not open in OPNET, though it
would work just fine in tethereal. Ran it through editcap, with the
"-F libpcap" (!), and the output file was just fine in OPNET. Go
figure!

HTH,
Stef


On Wed, 15 Dec 2004 16:36:39 -0500, Stephen Youndt
<syoundt@xxxxxxxxxxxxxxxxxxx> wrote:
Forgive me if this is documented somewhere, but I've been googling for a
couple of days without finding anything applicable.

I get the above mentioned message whenever I try to open a tcpdump
capture file on SPARC Solaris hosted ethereal.  The files open without
any problem in windows and linux, so it's not file corruption. In fact,
the same files work with tcpdump on the SPARC box. A similar message (a
different numeral) is displayed if I try to save a capture from within
ethereal even though the capture seems to work.

I can capture valid files with tethereal, but can't read them back with
[t]ethereal on SPARC. They work fine on x86 systems, though, and within
tcpdump on SPARC.

I've tried a couple different versions of Ethereal and libpcap including
direct downloads from SunFreeware, so my software build skills aren't
the common variable.

I suspect an alignment or endian problem, but I don't have enough
experience with the source to even begin to debug it.

Has anybody else seen this, and perhaps have a workaround or patch?

Thanks in advance,
Stephen


_______________________________________________
Ethereal-users mailing list
Ethereal-users@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-users





_______________________________________________
Ethereal-users mailing list
Ethereal-users@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-users


Attachment: smime.p7s
Description: S/MIME Cryptographic Signature