Re: pcap file format documentation

["Don Morrison" <donmorrison () gmail com>]

> Offhand I'd say this has nothing to do with truncation, since the
> truncated packet shouldn't be included in the clean pcap file. My guess
> would be that you've found a bug in one of ethereal's protocol dissectors.

Relax guys :) I'll send you the answer when I have time to fix it,
jeez. ;) I only had like 30 minutes to look at the problem today.

The reason why I suspect truncation is the following.  When I use
tethereal in my script, it cannot both output the text summary lines
and write to file at the same time.  Instead of hacking my own version
of tethereal, I did (not showing all options here:) tethereal -i eth0
-w - | tee filename | tethereal -i -

I think when this pipeline gets torn down, sometimes, a partial packet
is written.

Could it instead be a crashing dissector? Sure could be...I will then
poke a stick at the hornet's nest that is the Ethereal mailing list.
;)
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.