Package: libpcap0.8 Version: 1.8.1-3 Followup-For: Bug #846241 Dear Maintainer, Maybe libpcap could add the check for snaplen below MAXIMUM_SNAPLEN in pcap_setup_dump (or sf_write_header) too ...
but this issue is a bustle one. In c-sources/pcap-monitor.c bustle set pcap_t structure (with a call to pcap_opend_dead) with a snaplen of "1 <<<27" ie 134217728, which bigger than maximum of 262144 allowed by libpcap. When one read those file with bustle libpcap complains. I reported the issue upstream at: https://bugs.freedesktop.org/show_bug.cgi?id=100220 NB: there might be an issue in the libghc-pcap-dev package per the error reported looks like the latter try to convert the error from libpcap and fails at it. Adding a trace into this binding ( in withErrBuf of Network/Pcap/Base.hsc) made the issue obvious: invalid file capture length 134217728, bigger than maximum of 262144 -- System Information: Debian Release: 9.0 APT prefers unstable-debug APT policy: (500, 'unstable-debug'), (500, 'unstable'), (500, 'testing'), (1, 'experimental-debug'), (1, 'experimental') Architecture: amd64 (x86_64) Foreign Architectures: i386 Kernel: Linux 4.10.0-trunk-amd64 (SMP w/4 CPU cores) Locale: LANG=fr_FR.UTF-8, LC_CTYPE=fr_FR.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) Versions of packages libpcap0.8:amd64 depends on: ii libc6 2.24-9 libpcap0.8:amd64 recommends no packages. libpcap0.8:amd64 suggests no packages. -- no debconf information
