[tcpdump-workers] RFC: 802.11 capture patch

2006-03-24 Thread David Young
This patch adds support for the extended rates 802.11 Information Element (IE), changes a couple of u_char fields to u_int8_t, makes struct rates_t store 15 rates (sort of arbitrary, that), and displays both truncated SSIDs and rate sets. Please review. I hope to check it in, soon. I almost comp

Re: [tcpdump-workers] RFC: 802.11 capture patch

2006-03-24 Thread David Young
On Fri, Mar 24, 2006 at 10:06:25PM -0600, David Young wrote: > This patch adds support for the extended rates 802.11 Information Element > (IE), changes a couple of u_char fields to u_int8_t, makes struct rates_t > store 15 rates (sort of arbitrary, that), and displays both truncated > SSIDs and ra

Re: [tcpdump-workers] pcap file format documentation

2006-03-24 Thread Don Morrison
> Offhand I'd say this has nothing to do with truncation, since the > truncated packet shouldn't be included in the clean pcap file. My guess > would be that you've found a bug in one of ethereal's protocol dissectors. Relax guys :) I'll send you the answer when I have time to fix it, jeez. ;) I o

Re: [tcpdump-workers] pcap file format documentation

2006-03-24 Thread Jefferson Ogata
On 03/24/2006 04:35 PM, Don Morrison wrote: The trivial way to fix a truncated pcap file: tcpdump -r broken.pcap -w clean.pcap >>> >>>I tried this method, but it hangs tcpdump. >> >>That would be a bug in tcpdump. Why don't you send an example pcap file >>along that does this (or post

Re: [tcpdump-workers] pcap file format documentation

2006-03-24 Thread Guy Harris
On Mar 24, 2006, at 1:35 PM, Don Morrison wrote: My apologies, what I said was incorrect. Running the command does not crash tcpdump, but the outputfile ("clean.pcap") will crash Ethereal, so while both files are clean enough for tcpdump to display and not crash, not so for Ethereal. That do

Re: [tcpdump-workers] pcap file format documentation

2006-03-24 Thread Don Morrison
> >>The trivial way to fix a truncated pcap file: > >> > >>tcpdump -r broken.pcap -w clean.pcap > > > > I tried this method, but it hangs tcpdump. > > That would be a bug in tcpdump. Why don't you send an example pcap file > along that does this (or post it to a web or FTP site and send a URL), > a