tcpdump mailing list archives
Re: pcap files with file header snaplen < packet header caplen
From: "Aaron Turner" <synfinatic () gmail com>
Date: Thu, 30 Nov 2006 21:32:08 -0800
On 11/30/06, Guy Harris <guy () alum mit edu> wrote:
I'd suggest writing a small program to fix the snapshot length in those captures. It could, for example, scan through the file, find the maximum caplen, and then open the file for writing and write out the maximum of the snaplen value and the maximum caplen, in the right byte order, in the snaplen field.
Yeah, definitely doable. Is there a way to detect this situation via libpcap? I'd like to gracefully handle this issue rather then expect my users to notice that things aren't right. -- Aaron Turner http://synfin.net/ - This is the tcpdump-workers list. Visit https://cod.sandelman.ca/ to unsubscribe.
Current thread:
- pcap files with file header snaplen < packet header caplen Aaron Turner (Nov 30)
- Re: pcap files with file header snaplen < packet header caplen Guy Harris (Nov 30)
- Re: pcap files with file header snaplen < packet header caplen Aaron Turner (Nov 30)
- Re: pcap files with file header snaplen < packet Jefferson Ogata (Nov 30)
- Re: pcap files with file header snaplen < packet Aaron Turner (Nov 30)
- Re: pcap files with file header snaplen < packet Harley Stenzel (Dec 04)
- Re: pcap files with file header snaplen < packet Jefferson Ogata (Dec 04)
- Re: pcap files with file header snaplen < packet Harley Stenzel (Dec 04)
- Re: pcap files with file header snaplen < packet Gerald Combs (Dec 04)
- Re: pcap files with file header snaplen < packet Harley Stenzel (Dec 04)
- Re: pcap files with file header snaplen < packet Gianluca Varenni (Dec 04)
- Re: pcap files with file header snaplen < packet Guy Harris (Dec 04)
- Re: pcap files with file header snaplen < packet header caplen Guy Harris (Nov 30)
- Re: pcap files with file header snaplen < packet Aaron Turner (Dec 04)