Re: pcap files with file header snaplen < packet header caplen

["Aaron Turner" <synfinatic () gmail com>]

On 11/30/06, Guy Harris <guy () alum mit edu> wrote:
> I'd suggest writing a small program to fix the snapshot length in
> those captures.  It could, for example, scan through the file, find
> the maximum caplen, and then open the file for writing and write out
> the maximum of the snaplen value and the maximum caplen, in the right
> byte order, in the snaplen field.


Yeah, definitely doable.   Is there a way to detect this situation via
libpcap?  I'd like to gracefully handle this issue rather then expect
my users to notice that things aren't right.

--
Aaron Turner
http://synfin.net/
-
This is the tcpdump-workers list.
Visit https://cod.sandelman.ca/ to unsubscribe.