Re: pcap file format documentation

["Don Morrison" <donmorrison () gmail com>]

> Offhand I'd say this has nothing to do with truncation, since the
> truncated packet shouldn't be included in the clean pcap file. My guess
> would be that you've found a bug in one of ethereal's protocol dissectors.

Jefferson,

I finally got a chance to work on this.  You are correct, there was no
truncation.  I wrote a quick script to read through them all, and all
payload sizes match up, and there are no partial headers in the file,
so my next step will be to look at the Ethereal Dissectors.  Thanks
for the help.  Hopefully, I'll be allowed to send in the patch.

Regards,
Don
-
This is the tcpdump-workers list.
Visit https://lists.sandelman.ca/ to unsubscribe.