Wireshark-dev: Re: [Wireshark-dev] pcap with packet size >64k ?
From: warlord <[email protected]>
Date: Tue, 08 Jan 2008 08:46:40 +0100
Good idea Ulf. I attached a small pcap which includes a hostname request sent to the nameserver. As I took the liberty to hexedit the IP addresses the checksum is wrong, but that doesn't matter.
The two size fields in the pcap are 32 bits each, claiming the packet 
size was 4b 00 01 00(0x0001004b), which is 65611. When wireshark loads 
this pcap it complains about a packet size >65535.

Ulf Lamping wrote:
warlord schrieb:
Hash: RIPEMD160

Nope that was not the one :/

Might be a good idea to send a small (compressed) sample capture file to this list so someone can have a try ...
Regards, ULFL

dreaming in digital - living in realtime - thinking in binary - talking in IP - welcome to our world

Attachment: test2.pcap
Description: Binary data

Attachment: signature.asc
Description: OpenPGP digital signature