Comment # 1
on bug 10111
from Guy Harris
*Some* upper limit is required by `pcap_open_live()`, as the upper limit is one
of the arguments, and, even if you have `pcap_create()` and `pcap_activate()`,
so that you don't need to specify an upper limit, something needs to be
recorded as the "snapshot length" for the pcap file or the pcap-ng Interface
Description Block.
In theory, 0 could be used as "no upper limit" in the file, but there's code
that reads pcap and pcap-ng files and that naively allocate a buffer based on
that size. A very large value (2^31-1 or 2^32-1) could also be used, but said
naive code would run out of memory on 32-bit platforms in that case, and would
probably waste a huge chunk of address on 64-bit platforms.
So we might have to impose *some* limit in the "no limit" case. The question
is whether eliminating the "no limit" option would make the UI better or worse;
it's not clear to me that eliminating the option would be an improvement, as
the default case for most users is probably "limit? What's all this about a
limit?", and making them think about a limit at all might confuse them (which,
if they think "hey, this is Ethernet, the limit is 1500 bytes, right?", would
be a bad thing).
You are receiving this mail because:
- You are watching all bug changes.
