Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 8997] New: "Linux Cooked Capture" header has incorrect pad

Date: Wed, 31 Jul 2013 10:17:16 +0000
Bug ID 8997
Summary "Linux Cooked Capture" header has incorrect padding
Classification Unclassified
Product Wireshark
Version 1.10.1
Hardware x86-64
OS Ubuntu
Status UNCONFIRMED
Severity Minor
Priority Low
Component Capture file support (libwiretap)
Assignee [email protected]
Reporter [email protected]

Created attachment 11308 [details]
Packet with Linux cooked capture header.

Build Information:

--
Capture of packets in 'any device' mode was done on system B.

Reading the attached capture file on system A gives different result from
system B:

System A:
- Windows 7
- x86-64 
- Wireshark version 1.10.1

System B:
- Ubuntu 12.04.01
- x86-64
- Wireshark version 1.6.7

Reading the exact same capture file, system A says that the padding in the
Linux Cooked Capture is 2 bytes shorter than system B says it is. As a
consequence, 1.10.1 thinks that there is a 2-byte VSS monitoring trailer at the
end. I attach a packet as an example.

I actually don't know whether the problem is in 1.10.1 or in 1.6.7.


You are receiving this mail because:
  • You are watching all bug changes.