Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-dev: Re: [Wireshark-dev] Packet Size limited during capture message

From: Brian Oleksa <oleksab@xxxxxxxxxxxxxxxxxxxxxx>
Date: Tue, 23 Mar 2010 23:15:50 -0400
Bill

Ok...so I found out that it crashes on frame 17641.

It only took a couple of minuets to find it. But now what do I do with this info..??

Thanks,
Brian



Bill Meier wrote:
Brian Oleksa wrote:
Bill

Can you collaborate on this a little more..??

Do I want to pass in my .pcap file as the <infile> to which I am having problems with..??

And I am assuming that you want me to pass in the "ballpark" number (or a range) to where I think the crash occurs.

I can load about 70% of the file...which is right around frame # 16813.....

For example: C:\wireshark\editcap test.pcap -r 16813-20000 is this what you do..??

Thanks,
Brian




Yes:  Of course you also need to specify an <outfile>


editcap -r in.pcap out.pcap 16800-20000
tshark -nVxr out.pcap >foo.txt (crash)
editcap -r in.pcap out.pcap 18000-20000
tshark -nVxr out.pcap >foo.txt (no crash:
   ... so: bad frame(s) must be between 16800-17999
editcap -r in.pcap out.pcap 16800-17000
...


The process is a bit tedious and not necessarily worth the effort.
Also: sometimes multiple frames are needed.

Just using a debugger on the original file and seeing where the crash occurs may be all that is needed.




___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request@xxxxxxxxxxxxx?subject=unsubscribe