Ethereal fails on large capture file.Can you try to disable DCERPC in
edit/protocols, there are some suspected issues with dcerpc.
It may solve your immediate problem.
Can you try using the 'editcap' command line tool to cut the capture in
half and see which of the halves
ethereal crashes on.
Then cut that capture in half again and repeat until you have a very small
capture.
If that remaining capture does not contain any sensitive data you can mail
the capture to me to look at.
----- Original Message -----
From: Hounsell, Paul
To: '[EMAIL PROTECTED]'
Sent: Wednesday, May 14, 2003 11:21 PM
Subject: [Ethereal-users] Ethereal fails on large capture file.
Hello;
I really like your program but it is crashing when processing a
large snoop file (50Megs). I am trying to track down a problem on a busy
Solaris system. About 30 seconds of snoop capture is over 50 Megs. I am only
interested in about one Megabyte of that data. The question is how to filter
that 1 Megabyte out of the rest. I have pulled the capture file down to my
workstation. I run Ethereal 0.9.12 with a filter. At the 7 Megabyte mark
Ethereal crashes with the following error as shown in the attached gif. I
have also a Windows XP core dump if required.
How do I filter just the data I am interested in? Can this bug be
fixed? I understand that there is a limit to the amount of data any program
deals with but the program should not crash. I would appreciate any help.
Cheers
Paul
Paul Hounsell
system administrator
NAV CANADA
613 563 5963
_______________________________________________
Ethereal-users mailing list
[EMAIL PROTECTED]
http://www.ethereal.com/mailman/listinfo/ethereal-users
