Wireshark mailing list archives
Re: Wireshark (1.4.0) fails opening large file on Windows Vista 32-bit.
From: Tamás Varga <Tamas.Varga () ericsson com>
Date: Tue, 26 Oct 2010 09:40:10 +0200
Hi Jaap, Thank you very much for the description of memory related issues! The workaround, splitting the file into, was working for me. Fine! However, there are some issues, I have found no reference neither in wiki nor in bugzilla. I suspect this is not the expected behavior with respect to file >2GB: - capinfos.exe (Windows 32-bit) displays negative filesize - capinfos (Linux 32-bit) stops with "Value too large for defined data type" error - editcap (Linux 32-bit) stops with "Value too large for defined data type" error - tshark (Linux 32-bit) stops with "Value too large for defined data type" error - wireshark (Windows 32-bit) does not display the "Loading..." dialog and does not allow to stop loading a few percent of the file. Anyhow, the tools work well for ordinary (<2GB) files. And this is okay! cheers, Tamas ________________________________ From: wireshark-users-bounces () wireshark org [mailto:wireshark-users-bounces () wireshark org] On Behalf Of Jaap Keuter Sent: Monday, October 25, 2010 15:36 To: Community support list for Wireshark Subject: Re: [Wireshark-users] Wireshark (1.4.0) fails opening large file on Windows Vista 32-bit. Hi, http://wiki.wireshark.org/KnownBugs/OutOfMemory Thanks, Jaap On Mon, 25 Oct 2010 12:02:32 +0200, Tamás Varga <Tamas.Varga () ericsson com> wrote: Hi Wiresharkers, Complementing my earlier mail, I have made a little survey on the issue. With editcap, I have split the file into two parts, and it can be loaded: editcap -c 6000000 wa_00000_20100730043832.pcap wab.pcap However, tshark.exe fails to open the file, even in file-to-file mode with filter: tshark -r wa_00000_20100730043832.pcap -w wac.pcap -R "ip.addr == 10.110.156.17" Running capinfos.exe, yields negative file size: C:\Temp>capinfos wa_00000_20100730043832.pcap File name: wa_00000_20100730043832.pcap File type: Wireshark/tcpdump/... - libpcap File encapsulation: Ethernet Packet size limit: file hdr: 300 bytes Packet size limit: inferred: 300 bytes Number of packets: 11697799 File size: -1855096401 bytes Data size: 7220225590 bytes Capture duration: 60 seconds Start time: Fri Jul 30 04:38:32 2010 End time: Fri Jul 30 04:39:32 2010 Data byte rate: 119560482.40 bytes/sec Data bit rate: 956483859.19 bits/sec Average packet size: 617.23 bytes Average packet rate: 193705.10 packets/sec SHA1: f3fea0286f21f5ce8543e960f95b72503c40c953 RIPEMD160: e32e45c02492ecf54ffff0a1ff07bd895f70962e MD5: e18b4af9a612379a315780cfad7bd9df Strict time order: False With respect to my earlier mail, I was about to open the file and press STOP to prevent loading the entire file. (I was not expecting to fit a >2GB file into the user-space of 32-bit application). But the "Loading..." window does not appear. cheers, Tamas ________________________________ From: wireshark-users-bounces () wireshark org [mailto:wireshark-users-bounces () wireshark org] On Behalf Of Tamás Varga Sent: Monday, October 25, 2010 11:12 To: wireshark-users () wireshark org Subject: [Wireshark-users] Wireshark (1.4.0) fails opening large file on Windows Vista 32-bit. Hi Wiresharkers, I have received a large PCAP file on NTFS filesystem of size 2,439,870,895 bytes. Opening the file yields the following error message (after a long wating time): GLib-ERROR **: gmem.c:136: failed to allocate 4294967295 bytes aborting... To open the file, is it worth seeking for a 64-bit machine? Is largefile support planned in any 32-bit versions of Wireshark? cheers, Tamas
___________________________________________________________________________ Sent via: Wireshark-users mailing list <wireshark-users () wireshark org> Archives: http://www.wireshark.org/lists/wireshark-users Unsubscribe: https://wireshark.org/mailman/options/wireshark-users mailto:wireshark-users-request () wireshark org?subject=unsubscribe
Current thread:
- Wireshark (1.4.0) fails opening large file on Windows Vista 32-bit. Tamás Varga (Oct 25)
- Re: Wireshark (1.4.0) fails opening large file on Windows Vista 32-bit. Marco Simone Zuppone (Oct 25)
- Re: Wireshark (1.4.0) fails opening large file on Windows Vista 32-bit. Tamás Varga (Oct 25)
- Re: Wireshark (1.4.0) fails opening large file on Windows Vista 32-bit. Jaap Keuter (Oct 25)
- Re: Wireshark (1.4.0) fails opening large file on Windows Vista 32-bit. Tamás Varga (Oct 26)
- Re: Wireshark (1.4.0) fails opening large file on Windows Vista 32-bit. Guy Harris (Oct 26)
- Re: Wireshark (1.4.0) fails opening large file on Windows Vista 32-bit. Tamás Varga (Oct 26)
- Re: Wireshark (1.4.0) fails opening large file on Windows Vista 32-bit. Jaap Keuter (Oct 25)