Re: The capturefile appears to be damaged or corrupt. (pcap: Fileshas 109736-byte packet, bigger than maximum of 65535)

[Sake Blok <sake () euronet nl>]

On 17 mei 2010, at 22:17, Gianluca Varenni wrote:

> > the phdr struct is passed on from capture_loop_cb to libpcap_write_packet unaltered. So in my understanding 
> > pcap_dispatch must have supplied a wrong value of phdr->caplen for it to to faultly written to file. However this 
> > contradicts with the fact that the whole packet is indeed written after the header, because the following code 
> > should have trimmed the data to phr->caplen:
> >
> >      nwritten = fwrite(pd, 1, phdr->caplen, fp);
>
> This is what I was expecting. In the corrupted file, what the is value of the "len" field?

The packet header is:
BE 47 F1 4B FF ED 0B 00 62 00 00 00 66 00 00 00

ie incl_len is 98, while orig_len is 102

And the packet data is:
01 00 5E 00 05 DD 00 12 DA 9F 79 1B 08 00
45 00 00 58 00 00 40 00 18 11 7F A4 C6 8C 36 87 E0 00 05 DD
7E 35 20 1D 00 44 9F 74
00 3A 00 8C 00 0F DF 77 02 16 2C E4 6B 01 01 00 02 16 2C E2 00 00 00 00 00 05 30 20 00 00 00 07 00 05 2F 58 00 00 00 02 
04 4E 45 52 43 41 48 00 00 00 00 00 00 00 00 00 00 00 00 00

ie 14 bytes ethernet header, 20 bytes IP header, 8 bytes UDP header and 60 bytes payload => 102 (0x66) bytes in total

Cheers,
Sake

 

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe