ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Wireshark-users: Re: [Wireshark-users] Editcap 100 argument limitation?

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 19 Jun 2007 14:25:03 -0700

On Jun 19, 2007, at 1:48 PM, Rob Campbell wrote:

Is this limit intentional or can it be removed?

The answer to your question is "yes", because it's the "or" of two subquestions, and the answer to both of them is "yes". :-)

The limit is "intentional", in the sense that the code has an explicit limit of 100 ranges in it.

The limit can be removed, in the sense that the array edit uses to hold ranges can be made a dynamically expandable array rather than the current statically-allocated fixed-size array.

Is this a unix/linux limitation?

No. The OS kernel and shell limitations would have prevented you from running the command in the first place, and even in the feeblest of systems they're big enough for 100 ranges. (In the best of systems you can pass a megabyte or more of command-line arguments; SunOS 4.0 had a 1-megabyte limitation, about *20 years ago*, and many other Un*xes *STILL* have smaller limits, sigh.)