[prev in list] [next in list] [prev in thread] [next in thread] 

List:       winpcap-users
Subject:    RE: [Winpcap-users] I can't seem to read more than
From:       "Isaacks, John H" <john.isaacks () eds ! com>
Date:       2007-10-16 13:57:01
Message-ID: 04F196AE5755DD4587D3F8AE1A9F7B4001475839 () usahm213 ! amer ! corp ! eds ! com
[Download RAW message or body]


It seems the process that wrote this file was not using winpcap and it
had set the snaplen in the file header to zero
Instead of 65535. I just patch this in the file before using winpcap to
read it.

I was just trying to resend some captured data in our lab for testing
purposes and I wasn't able to resending because I couldn't read the
file. Thanks for the help.
 


John Isaacks
EDS - ITMS Production support

-----Original Message-----
From: winpcap-users-bounces@winpcap.org
[mailto:winpcap-users-bounces@winpcap.org] On Behalf Of Guy Harris
Sent: Tuesday, October 16, 2007 2:11 AM
To: winpcap-users@winpcap.org
Subject: Re: [Winpcap-users] I can't seem to read more than 16bytes
fromanoffline file

Isaacks, John H wrote:
> yes, I can use ethereal to view the original file, it looks fine.

Can you use WinDump to read the file?
_______________________________________________
Winpcap-users mailing list
Winpcap-users@winpcap.org
https://www.winpcap.org/mailman/listinfo/winpcap-users

_______________________________________________
Winpcap-users mailing list
Winpcap-users@winpcap.org
https://www.winpcap.org/mailman/listinfo/winpcap-users
[prev in list] [next in list] [prev in thread] [next in thread]