4/1/2023 0 Comments Wireshark pcapng![]() ![]() Large-shb-comment.pcapng Relevant logs and/or screenshots The capture file should not get corrupted because of the size of the file comment text. This bug was discovered when a large amount of the CLI output from a set of DNS "dig" commands was attempted to be saved as a file comment to the pcapng file that recorded the results of the various dig commands. The capture file becomes unusable if the file comment is too big when the file is saved. Note 2: Starting with the same test file large-shb-comment.pcapng, if only a single extra character is added to the comment block and saved to a new file, then the entire comment block will be silently missing from the newly created pcpang file. ![]() When the capinfos utility is used to display the file level comment, the various comment records as concatenated together as if is no end-of-line characters. This implies a an apparent current max file comment size of 65536 bytes ((897 * (72+1)) + 55). Note 1: The original comment data added to this pcapng file was composed of 897 lines of 72 bytes of text plus a 73rd byte for the new line character followed by one final line of 55 bytes of text without the newline character. (pcapng: total block lengths (first 40 and second 20) don't match) The file "XXlarge-shb-comment.pcapng" appears to be damaged or corrupt. ![]()
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |