Marco van den Bovenkamp wrote:
Xavier Brouckaert wrote:
How do you do that ? Is there a tool for this ? editcap cannot remove
a single broken packet.
No? Assuming it doesn't choke on the bogus packet, and you know its'
sequence number, something like 'editcap <#
of bogus packet>' should do it
Xavier Brouckaert wrote:
How do you do that ? Is there a tool for this ? editcap cannot remove a
single broken packet.
No? Assuming it doesn't choke on the bogus packet, and you know its'
sequence number, something like 'editcap <#
of bogus packet>' should do it...
--
Regards
On Jun 25, 2004, at 4:34 PM, Xavier Brouckaert wrote:
Could it happen because there are several applications using libpcap
at the same time ?
Not if they're writing to different files. There's no data that would
be shared by all libpcap-using processes on a given machine.
If multiple applicatio
Jefferson Ogata wrote:
This usually happens to me when I have a disk full condition while
capturing. Captures stop getting flushed to disk until some space is
cleared, and when they restart a header is no longer in the right place
because a lot of buffered data was lost.
I have 39Gb left so I do
Xavier Brouckaert wrote:
I have several corrupted pcap files. The error message looks like this
when I try to reread the trace with tethereal :
This usually happens to me when I have a disk full condition while capturing.
Captures stop getting flushed to disk until some space is cleared, and when
Hi,
I have several corrupted pcap files. The error message looks like this
when I try to reread the trace with tethereal :
$ tethereal -r asax_24_juin_13h47.cap -w asax_24_juin_13h47-2.cap
tethereal: "asax_24_juin_13h47.cap" appears to be damaged or corrupt.
(pcap: File has 536022498-byte packet
