Re: [tcpdump-workers] [pcap-ng-format] sane maximum length for block_length

2019-09-24 Thread Guy Harris
On Sep 20, 2019, at 2:02 PM, Michael Richardson wrote: > Guy Harris wrote: >> Currently, Wireshark's pcapng reading code imposes a block size limit >> for all blocks: > >> enough that * the resulting block size would be less than the previous >> 16 MiB limit. */ #define MAX_BLOCK_SIZE (MIN_EPB

Re: [tcpdump-workers] [pcap-ng-format] sane maximum length for block_length

2019-09-20 Thread Guy Harris
On Sep 18, 2019, at 3:59 PM, Michael Richardson wrote: > It seems to be that numbers bigger than 1MB here for a *Section Header Block* > should be more than enough. If we knew the size of the file (it's not a > pipe, and it's not coming from a stream de-compressor), then we could set > another