Packet detection inside another packet leads to corruption.

Rup0rt / pcapfix

repair corrupted pcap files

http://f00l.de/pcapfix/

GNU General Public License v3.0

202 stars 34 forks source link

Packet detection inside another packet leads to corruption. #21

Closed mdeweerd closed 3 years ago

mdeweerd commented 3 years ago

The example is for a good pcap file - I tried to fix another pcap file that is only partially corrupted, but applying pcapfix did more harm than good for the reason put forward in this test case.

The corrected file has less packets than good source pcap.

The testcase has a 'tc.sh' file that acts on the sample file and demnstrates that the output has less packets than the original while the original is perfectly fine. pcapfixtc20201227.zip

Rup0rt commented 3 years ago

Seems that pcap packet header size can be smaller than fixed limit of 10 bytes. I added an exception for DLT 195 which should fix your problem. Thank you very much for your file, I am going to use it in future test cases.