<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD><TITLE>I can't seem to read more than 16 bytes from an offline file</TITLE>
<META http-equiv=Content-Type content="text/html; charset=us-ascii">
<META content="MSHTML 6.00.2900.3157" name=GENERATOR>
<STYLE></STYLE>
</HEAD>
<BODY bgColor=#ffffff>
<DIV dir=ltr align=left><FONT face=Arial><FONT color=#0000ff><FONT size=2><SPAN
class=440110415-15102007>I had ethereal write a new file then compared the two
files.<SPAN
class=569330715-15102007> </SPAN></SPAN></FONT></FONT></FONT></DIV>
<DIV dir=ltr align=left><FONT face=Arial><FONT color=#0000ff><FONT
size=2><FONT><FONT><SPAN class=440110415-15102007><SPAN
class=569330715-15102007> </SPAN></SPAN><SPAN class=440110415-15102007>they
are identical except for two bytes.<SPAN
class=569330715-15102007> </SPAN></SPAN></FONT></FONT></FONT></FONT></FONT></DIV>
<DIV dir=ltr align=left><FONT face=Arial><FONT color=#0000ff><FONT
size=2><FONT><FONT><FONT><FONT><SPAN class=440110415-15102007><SPAN
class=569330715-15102007> </SPAN></SPAN></FONT></FONT><SPAN
class=440110415-15102007>16 bytes into the each file, the one that reads fine
has 0xFF 0xFF.<SPAN
class=569330715-15102007> </SPAN></SPAN></FONT></FONT></FONT></FONT></FONT></DIV>
<DIV dir=ltr align=left><FONT face=Arial><FONT color=#0000ff><FONT
size=2><FONT><FONT><SPAN class=440110415-15102007><SPAN
class=569330715-15102007> </SPAN></SPAN></FONT></FONT><SPAN
class=440110415-15102007>the file that only reads 16 bytes per packet has 0x00
0x00</SPAN></FONT></FONT></FONT></DIV>
<BLOCKQUOTE dir=ltr style="MARGIN-RIGHT: 0px">
<DIV> </DIV><!-- Converted from text/rtf format -->
<P><SPAN lang=en-us><FONT face=Arial size=2>John Isaacks</FONT></SPAN>
<BR><SPAN lang=en-us><FONT face=Arial size=2>EDS - ITMS Production
support</FONT></SPAN> </P>
<DIV> </DIV><BR>
<BLOCKQUOTE dir=ltr style="MARGIN-RIGHT: 0px">
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> Isaacks, John H <BR><B>Sent:</B>
Monday, October 15, 2007 2:39 PM<BR><B>To:</B>
'winpcap-users@winpcap.org'<BR><B>Subject:</B> RE: [Winpcap-users] I can't
seem to read more than 16 bytes fromanoffline file<BR></FONT><BR></DIV>
<DIV></DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff
size=2></FONT> </DIV>
<DIV dir=ltr align=left><SPAN class=752043714-15102007><FONT face=Arial
color=#0000ff size=2>it seems that if I select packets out of the original
file and have ethereal write a new file, the new file can be read by my
program and the example programs.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=752043714-15102007><FONT face=Arial
color=#0000ff size=2>I will select all of the packets out and write a
new file.</FONT></SPAN></DIV>
<DIV dir=ltr align=left><SPAN class=752043714-15102007><FONT face=Arial
color=#0000ff size=2></FONT></SPAN> </DIV>
<DIV> </DIV><!-- Converted from text/rtf format -->
<P><SPAN lang=en-us><FONT face=Arial size=2>John Isaacks</FONT></SPAN>
<BR><SPAN lang=en-us><FONT face=Arial size=2>EDS - ITMS Production
support</FONT></SPAN> </P>
<DIV> </DIV><BR>
<BLOCKQUOTE dir=ltr style="MARGIN-RIGHT: 0px">
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> winpcap-users-bounces@winpcap.org
[mailto:winpcap-users-bounces@winpcap.org] <B>On Behalf Of </B>Gianluca
Varenni<BR><B>Sent:</B> Friday, October 12, 2007 11:49 PM<BR><B>To:</B>
winpcap-users@winpcap.org<BR><B>Subject:</B> Re: [Winpcap-users] I can't
seem to read more than 16 bytes fromanoffline file<BR></FONT><BR></DIV>
<DIV></DIV>
<DIV><FONT size=2>Does wireshark/ethereal open the same file
properly?</FONT></DIV>
<DIV><FONT size=2></FONT> </DIV>
<DIV><FONT size=2>Have a nice day</FONT></DIV>
<DIV><FONT size=2>GV</FONT></DIV>
<DIV> </DIV>
<DIV><FONT size=2></FONT> </DIV>
<BLOCKQUOTE
style="PADDING-RIGHT: 0px; PADDING-LEFT: 5px; MARGIN-LEFT: 5px; BORDER-LEFT: #000000 2px solid; MARGIN-RIGHT: 0px">
<DIV style="FONT: 10pt arial">----- Original Message ----- </DIV>
<DIV
style="BACKGROUND: #e4e4e4; FONT: 10pt arial; font-color: black"><B>From:</B>
<A title=john.isaacks@eds.com
href="mailto:john.isaacks@eds.com">Isaacks, John H</A> </DIV>
<DIV style="FONT: 10pt arial"><B>To:</B> <A
title=winpcap-users@winpcap.org
href="mailto:winpcap-users@winpcap.org">winpcap-users@winpcap.org</A>
</DIV>
<DIV style="FONT: 10pt arial"><B>Sent:</B> Friday, October 12, 2007 2:01
PM</DIV>
<DIV style="FONT: 10pt arial"><B>Subject:</B> [Winpcap-users] I can't
seem to read more than 16 bytes from anoffline file</DIV>
<DIV><BR></DIV><!-- Converted from text/rtf format --><BR>
<P><FONT face=Arial size=2>I'm trying to read a captured ethereal file (
pcap ).</FONT> <BR><FONT face=Arial size=2>My code used to work fine,
but now doesn't work on any of my machines.</FONT> <BR><FONT face=Arial
size=2>I was using 3.1 but I have installed lastest 4.0.1 on my pc and I
get the same results as before.</FONT> <BR><FONT face=Arial size=2>I
have reverted to simple readfile.c example and the</FONT> <FONT
face="Courier New" color=#0000ff size=2>const</FONT><FONT
face="Courier New" size=2> </FONT><FONT face="Courier New" color=#0000ff
size=2>struct</FONT><FONT face="Courier New" size=2> pcap_pkthdr
*header->caplen is always 16 bytes ( 0x10 )</FONT></P>
<P><FONT face=Arial size=2>I even tried the readfile_ex.c version and I
get the same 16 bytes as the caplen.</FONT> </P><BR>
<P><FONT face=Arial size=4>John Isaacks</FONT> <BR><FONT face=Arial
size=2>EDS - ITMS Production support</FONT> <BR><FONT face=Arial
size=2>MS 216</FONT> <BR><FONT face=Arial size=2>3450 Lakeside Dr</FONT>
<BR><FONT face=Arial size=2>Miramar, FL 33027-3277</FONT> </P>
<P><FONT face=Arial> </FONT><FONT face=Arial
size=2>Phone:+1-954-433-6653</FONT> <BR><FONT face=Arial size=2>+</FONT>
<A href="mailto:john.isaacks@eds.com"><U><FONT face=Arial color=#0000ff
size=2>mailto:john.isaacks@eds.com</FONT></U></A> </P><BR>
<P>
<HR>
<P></P>_______________________________________________<BR>Winpcap-users
mailing
list<BR>Winpcap-users@winpcap.org<BR>https://www.winpcap.org/mailman/listinfo/winpcap-users<BR></BLOCKQUOTE></BLOCKQUOTE></BLOCKQUOTE></BLOCKQUOTE></BODY></HTML>