> Offhand I'd say this has nothing to do with truncation, since the > truncated packet shouldn't be included in the clean pcap file. My guess > would be that you've found a bug in one of ethereal's protocol dissectors.
Jefferson, I finally got a chance to work on this. You are correct, there was no truncation. I wrote a quick script to read through them all, and all payload sizes match up, and there are no partial headers in the file, so my next step will be to look at the Ethereal Dissectors. Thanks for the help. Hopefully, I'll be allowed to send in the patch. Regards, Don - This is the tcpdump-workers list. Visit https://lists.sandelman.ca/ to unsubscribe.
