--------------------------------------------------
From: "Sake Blok" <sake@xxxxxxxxxx>
Sent: Monday, May 17, 2010 1:38 PM
To: "Community support list for Wireshark" <wireshark-users@xxxxxxxxxxxxx>
Cc: "Gianluca Varenni" <gianluca.varenni@xxxxxxxxxxxx>
Subject: Re: [Wireshark-users] The capturefile appears to be damaged orcorrupt.(pcap: Fileshas 109736-byte packet, bigger than maximum of 65535)
On 17 mei 2010, at 22:17, Gianluca Varenni wrote:
the phdr struct is passed on from capture_loop_cb to
libpcap_write_packet unaltered. So in my understanding pcap_dispatch
must have supplied a wrong value of phdr->caplen for it to to faultly
written to file. However this contradicts with the fact that the whole
packet is indeed written after the header, because the following code
should have trimmed the data to phr->caplen:
nwritten = fwrite(pd, 1, phdr->caplen, fp);
This is what I was expecting. In the corrupted file, what the is value of
the "len" field?
The packet header is:
BE 47 F1 4B FF ED 0B 00 62 00 00 00 66 00 00 00
ie incl_len is 98, while orig_len is 102
Which is totally legal... I have no idea, apart from adding assertions in
the dumpcap code, hoping to spot something weird.
GV
And the packet data is:
01 00 5E 00 05 DD 00 12 DA 9F 79 1B 08 00
45 00 00 58 00 00 40 00 18 11 7F A4 C6 8C 36 87 E0 00 05 DD
7E 35 20 1D 00 44 9F 74
00 3A 00 8C 00 0F DF 77 02 16 2C E4 6B 01 01 00 02 16 2C E2 00 00 00 00 00
05 30 20 00 00 00 07 00 05 2F 58 00 00 00 02 04 4E 45 52 43 41 48 00 00 00
00 00 00 00 00 00 00 00 00 00
ie 14 bytes ethernet header, 20 bytes IP header, 8 bytes UDP header and 60
bytes payload => 102 (0x66) bytes in total
Cheers,
Sake
