Bill Can you collaborate on this a little more..??
Do I want to pass in my .pcap file as the <infile> to which I am having problems with..?? And I am assuming that you want me to pass in the "ballpark" number (or a range) to where I think the crash occurs. I can load about 70% of the file...which is right around frame # 16813..... For example: C:\wireshark\editcap test.pcap -r 16813-20000 is this what you do..?? Thanks, Brian Bill Meier wrote: > Brian Oleksa wrote: > >> Guy >> >> The 70% that I can load has a bunch of helen packets in it and every one >> of the helen packets has the >> "Packet size limited during capture" message. Even the very first helen >> packet. >> >> I do not believe that one packet relies on one another. A packet is just >> a packet. >> >> I will have to use the debugger to dig deeper into this one. >> >> Thanks, >> Brian >> >> >> > > The standard way I approach this type of situation is to first use > editcap -r m-n (where m & n are frame numbers) repeatedly to extract a > portion of the capture file and then see if I get a crash with that portion. > > In effect, I do a kind of binary search to get the minimum number of > frames (hopefully one frame) in the capture file to cause a crash. > > (This is easier if the crash occurs with tshark). > > > > ___________________________________________________________________________ > Sent via: Wireshark-dev mailing list <[email protected]> > Archives: http://www.wireshark.org/lists/wireshark-dev > Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev > mailto:[email protected]?subject=unsubscribe > ___________________________________________________________________________ Sent via: Wireshark-dev mailing list <[email protected]> Archives: http://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:[email protected]?subject=unsubscribe
