search

Rup0rt / pcapfix

repair corrupted pcap files
http://f00l.de/pcapfix/
GNU General Public License v3.0
202 stars 34 forks source link

add fix for interface type error #23

Closed sergey-safarov closed 3 years ago

sergey-safarov commented 3 years ago

I cannot parse pcap in the attached file. Example:

[safarov@safarov-dell tmp]$ tcpdump -r interface-type-error.pcapng
reading from file /home/safarov/interface-type-error.pcapng, link-type LINUX_SLL (Linux cooked v1)
tcpdump: pcap_loop: an interface has a type 1 different from the type of the first interface

Could you also add support to fix this type of error?

interface-type-error.pcapng.gz

Rup0rt commented 3 years ago

Hi sergey,

I checked your file and pcapng specifications and it does look to me that having 2 interfaces with different types is good for the pcapng file format. So it seems that this is a missing feature in tcpdump.

Let me know, if you think that I am wrong.

sergey-safarov commented 3 years ago

Yes, you a right. I have downloaded many_interfaces.pcapng from page Relevant page.

And then checked using the same command and get the same error.

[user@example home]$ tcpdump -r ~/Downloads/many_interfaces.pcapng 
reading from file /home/safarov/Downloads/many_interfaces.pcapng, link-type EN10MB (Ethernet)
tcpdump: pcap_loop: an interface has a type 0 different from the type of the first interface

So looks like the required support of PCAPNG support in the other program or convert to PCAP format.

libpcap do not support pcapng format