FW: [Winpcap-users] I can't seem to read more than 16 bytes fromanoffline file

[Isaacks, John H]

I had ethereal write a new file then compared the two files. 
 they are identical except for two bytes. 
 16 bytes into the each file, the one that reads fine has 0xFF 0xFF. 
 the file that only reads 16 bytes per packet has 0x00 0x00

	 

	John Isaacks 
	EDS - ITMS Production support 

	 


________________________________

		From: Isaacks, John H 
		Sent: Monday, October 15, 2007 2:39 PM
		To: 'winpcap-users at winpcap.org'
		Subject: RE: [Winpcap-users] I can't seem to read more
than 16 bytes fromanoffline file
		
		
		 
		it seems that if I select packets out of the original
file and have ethereal write a new file, the new file can be read by my
program and the example programs.
		I will select all of the packets out and write a new
file.
		 
		 

		John Isaacks 
		EDS - ITMS Production support 

		 


________________________________

			From: winpcap-users-bounces at winpcap.org
[mailto:winpcap-users-bounces at winpcap.org] On Behalf Of Gianluca Varenni
			Sent: Friday, October 12, 2007 11:49 PM
			To: winpcap-users at winpcap.org
			Subject: Re: [Winpcap-users] I can't seem to
read more than 16 bytes fromanoffline file
			
			
			Does wireshark/ethereal open the same file
properly?
			 
			Have a nice day
			GV
			 
			 

				----- Original Message ----- 
				From: Isaacks, John H
<mailto:john.isaacks at eds.com>  
				To: winpcap-users at winpcap.org 
				Sent: Friday, October 12, 2007 2:01 PM
				Subject: [Winpcap-users] I can't seem to
read more than 16 bytes from anoffline file



				I'm trying to read a captured ethereal
file ( pcap ). 
				My code used to work fine, but now
doesn't work on any of my machines. 
				I was using 3.1 but I have installed
lastest 4.0.1 on my pc and I get the same results as before. 
				I have reverted to simple readfile.c
example and the const struct pcap_pkthdr *header->caplen is always 16
bytes ( 0x10 )

				I even tried the readfile_ex.c version
and I get the same 16 bytes as the caplen. 


				John Isaacks 
				EDS - ITMS Production support 
				MS 216 
				3450 Lakeside Dr 
				Miramar, FL  33027-3277 

				 Phone:+1-954-433-6653 
				+ mailto:john.isaacks at eds.com
<mailto:john.isaacks at eds.com>  


				
________________________________


				

	
_______________________________________________
				Winpcap-users mailing list
				Winpcap-users at winpcap.org
	
https://www.winpcap.org/mailman/listinfo/winpcap-users
				

-------------- next part --------------
An HTML attachment was scrubbed...
URL: http://www.winpcap.org/pipermail/winpcap-users/attachments/20071015/3211cf47/attachment-0001.htm