Wireshark-dev: Re: [Wireshark-dev] pcap with packet size >64k ?
From: warlord <[email protected]>
Date: Tue, 08 Jan 2008 08:46:40 +0100
Good idea Ulf. I attached a small pcap which includes a hostname request sent to the nameserver. As I took the liberty to hexedit the IP addresses the checksum is wrong, but that doesn't matter.
The two size fields in the pcap are 32 bits each, claiming the packet 
size was 4b 00 01 00(0x0001004b), which is 65611. When wireshark loads 
this pcap it complains about a packet size >65535.
wrl

Ulf Lamping wrote:
warlord schrieb:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: RIPEMD160

Nope that was not the one :/
Hi!

Might be a good idea to send a small (compressed) sample capture file to this list so someone can have a try ...
Regards, ULFL


--
dreaming in digital - living in realtime - thinking in binary - talking in IP - welcome to our world

Attachment: test2.pcap
Description: Binary data

Attachment: signature.asc
Description: OpenPGP digital signature