Re: How to read a big pcap file?

["Subhasis Mohapatra (submohap)" <submohap () cisco com>]

Thanks for the information,
I was using an older version of libpcap.

My pcap file is greater then 4GB and in Linux platform.
It was giving an error like "Unable to read the pcap file".

Thanks,
Subhasis

-----Original Message-----
From: tcpdump-workers-owner () lists tcpdump org
[mailto:tcpdump-workers-owner () lists tcpdump org] On Behalf Of Guy Harris
Sent: Wednesday, October 20, 2010 2:19 PM
To: tcpdump-workers () lists tcpdump org
Subject: Re: [tcpdump-workers] How to read a big pcap file?


On Oct 19, 2010, at 5:52 AM, Subhasis Mohapatra (submohap) wrote:

> I have designed a tool using libpcap,but its not reading big pcaps.

What does "big" mean here?  Larger than 2GB, larger than 4GB, or larger
than some other value?

What happens if your tool tries to read a big pcap file?

What operating system is this on, and what version of libpcap is your
program linked with?

Older versions of libpcap might not support files >2GB (or possibly
> 4GB) on some platforms; newer versions (1.0.0 and later) should support
them on all platforms where the underlying OS supports them.  (On *BSD
and Mac OS X, all versions should support files >4GB.)-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.