Wireshark · Ethereal-users: Re: [Ethereal-users] pcap: File has 4294949296-byte packet, bigger than maximum of 65535

[Stephen Youndt <syoundt@xxxxxxxxxxxxxxxxxxx>]

I just tested it on my Mac, and it works fine with 0.10.3, which is the 
newest available through Fink. I've not yet gotten 0.10.7 to compile on 
OS X, but given that the SPARC failed on multiple versions I don't 
expect to learn anything more from that.

I guess we know it's not an endian problem, then.

Stef, I also get the same error when I load snoop files.

This is really peculiar because I've used Ethereal on SPARC Solaris a 
number of times. I think the strangest thing is that I get the error 
using tethereal to read a dump file that it just finished writing. WTF. 
I hate Sun.

Guy Harris wrote:

> Stephen Youndt wrote:
>
> > I suspect an alignment or endian problem, but I don't have enough 
> > experience with the source to even begin to debug it.
>
>
> It's probably not an endian problem; if you can send me one of the 
> captures, I can check whether it's purely an endian problem, by seeing 
> whether I can read it on my big-endian PowerBook.
>
> I suspect it's not an alignment problem, either.
>
> It *might* be a problem with the heuristics Ethereal uses to try to 
> guess which of the incompatible formats, with the same magic number, 
> the file is in.
>
> _______________________________________________
> Ethereal-users mailing list
> Ethereal-users@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-users

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature