Guy Harris <[EMAIL PROTECTED]> writes:
> On Wed, Jul 04, 2001 at 09:08:08PM -0400, Mohamed LRHAZI wrote:
> > I think the box I am on is Linux 2.4.3
> >
> > # uname -a
> > Linux proxy 2.4.3-20mdk #1 Sun Apr 15 23:03:10 CEST 2001 i686 unknown
>
> ...but, as Jason noted:
>
> > > And I seem to recall that applications that want to support > 2G
> > > files must also use e.g. off64_t.
>
> Libpcap doesn't directly use "open()" and "write()" to write capture
> files; instead, it uses "fopen()" and "fwrite()", which means that the
> "standard I/O library" routines in glibc would have to use a 64-bit file
> offset type internally in order to support access to files > 2GB on
> 32-bit Linux platforms. I don't know whether it does so; if it doesn't,
> tcpdump won't support captures > 2GB on those platforms.
If that's the problem, here's a workaround, assuming cat(1) supports
large files:
/usr/sbin/tcpdump -w/dev/fd/1 |cat >/tmp/test
If cat can't handle large files, then probably nothing on your system
will, and you're out of luck.
Make sure you stop it by killing tcpdump instead of hitting CTRL-C;
CTRL-C kills cat, and nothing gets written.
-----ScottG.
-
This is the TCPDUMP workers list. It is archived at
http://www.tcpdump.org/lists/workers/index.html
To unsubscribe use mailto:[EMAIL PROTECTED]?body=unsubscribe
