https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=14595
Martin Kaiser <[email protected]> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |[email protected]
Status|UNCONFIRMED |IN_PROGRESS
Ever confirmed|0 |1
--- Comment #1 from Martin Kaiser <[email protected]> ---
For each packet, this pcap file has 4 additional bytes between packet header
and the actual packet data.
Wiretap's libpcap code tries to figure out the number of bytes between packet
header and packet data (there are none by default). We get it wrong for this
file and assume that there are 8 additional bytes. The reading gets out of sync
and we mis-interpret the packet headers.
I'll look into this some more as time permits.
We might be able to improve the code that detects how big the gap is between
header and packet data. At the moment, we iterate over the possible gap sizes
until we're able to read the first two packets without errors. We could
increase this number (the sample file's problems start in packet 3...).
BTW the pcap file dissector doesn't handle additional bytes between packet
header and packet data at all.
--
You are receiving this mail because:
You are watching all bug changes.___________________________________________________________________________
Sent via: Wireshark-bugs mailing list <[email protected]>
Archives: https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
mailto:[email protected]?subject=unsubscribe
