pcapfix states that a valid pcap file built by current tcpdump or tshark is corrupt

Rup0rt / pcapfix

repair corrupted pcap files

http://f00l.de/pcapfix/

GNU General Public License v3.0

202 stars 34 forks source link

pcapfix states that a valid pcap file built by current tcpdump or tshark is corrupt #12

Closed fxlb closed 6 years ago

fxlb commented 6 years ago

Hi, Currently, the default capture length for pcap files by tcpdump (and tshark) is 262144. For such valid pcap files, pcapfix gives the message: [-] The global pcap header seems to be corrupt! ==> CORRECTED and correct the capture length to 65535. Could you change this behaviour ?

Rup0rt commented 6 years ago

Thanks for reporting this bug. I didn't recognize the snaplen change in the past and gonna fix this soon!

fxlb commented 6 years ago

Thanks!