Re: Packet Size limited during capture message

[Bill Meier <wmeier () newsguy com>]

Brian Oleksa wrote:
> Guy
>
> The 70% that I can load has a bunch of helen packets in it and every one 
> of the helen packets has the
> "Packet size limited during capture" message. Even the very first helen 
> packet.
>
> I do not believe that one packet relies on one another. A packet is just 
> a packet.
>
> I will have to use the debugger to dig deeper into this one.
>
> Thanks,
> Brian

The standard way I approach this type of situation is to first use
editcap -r m-n   (where m & n are frame numbers) repeatedly to extract a 
portion of the capture file and then see if I get a crash with that portion.

In effect, I do a kind of binary search to get the minimum  number of 
frames (hopefully one frame) in the capture file to cause a crash.

(This is easier if the crash occurs with tshark).



___________________________________________________________________________
Sent via:    Wireshark-dev mailing list <wireshark-dev () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-dev
Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev
             mailto:wireshark-dev-request () wireshark org?subject=unsubscribe