https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7851
Summary: We don't handle pcap-ng files with IDBs that come
after packet blocks
Product: Wireshark
Version: SVN
Platform: All
OS/Version: All
Status: NEW
Severity: Major
Priority: Low
Component: Capture file support (libwiretap)
AssignedTo: bugzilla-admin@xxxxxxxxxxxxx
ReportedBy: guy@xxxxxxxxxxxx
Created attachment 9342
--> https://bugs.wireshark.org/bugzilla/attachment.cgi?id=9342
pcap-ng file with an IDB following the first packet
Build Information:
wireshark 1.9.0 (SVN Rev 45463 from /trunk)
Copyright 1998-2012 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled (64-bit) with GTK+ 2.24.10, with Cairo 1.12.2, with Pango 1.30.0, with
GLib 2.32.3, with libpcap, with libz 1.2.5, without POSIX capabilities, without
libnl, with SMI 0.4.8, without c-ares, without ADNS, with Lua 5.1, without
Python, with GnuTLS 2.12.19, with Gcrypt 1.5.0, with MIT Kerberos, with GeoIP,
with PortAudio V19-devel (built Sep 7 2012 18:21:16), with AirPcap.
Running on Mac OS X 10.8.2, build 12C54 (Darwin 12.2.0), with locale
en_US.UTF-8, with libpcap version 1.1.1, with libz 1.2.5, GnuTLS 2.12.19,
Gcrypt
1.5.0, without AirPcap.
Built using llvm-gcc 4.2.1 (Based on Apple Inc. build 5658) (LLVM build
2336.11.00).
--
There is no guarantee that all Interface Description Blocks in a pcap-ng file
will be at the beginning of the file, nor should there ever be such a
guarantee.
For example, some program that writes pcap-ng files could start capturing from
the interfaces that the machine has at the time the capture is started and, if
new interfaces appear while the capture is in progress, start capturing on
those interfaces as well. (I have some ideas about how to implement that in
BPF, and may do that in my Copious Free Time(TM) and send the implementation
off to Apple and the *BSDs at some point.)
Here's a pcap-ng file I synthesized from a file in the Wireshark menagerie; it
has packets from two interfaces, and the IDB for each interface appears
immediately before the EPB for the packet on that interface. It fails with
tshark: The file "/Users/gharris/captures/pcapng/idb-in-the-middle.pcapng"
appears to be damaged or corrupt.
(pcapng: interface index 1 is not less than interface count 1.)
if I hand it to top-of-trunk TShark.
(I'm filing a bug on this in part just to put the pcap-ng file into the
menagerie, so that it gets handed to TShark by the buildbot. I'll be
submitting a fix.)
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.
