[Wireshark-bugs] [Bug 15707] Wireshark fails on piped/streamed pcapng packet capture data with mixed BE/LE SHBs, but reads mixed BE/LE files correctly
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15707 --- Comment #16 from Gerrit Code Review --- Change 36981 had a related patch set uploaded by Guy Harris: Support reading mixed-byte-order pcapng files. https://code.wireshark.org/review/36981 -- You are receiving this mail because: You are watching all bug changes.___ Sent via:Wireshark-bugs mailing list Archives:https://www.wireshark.org/lists/wireshark-bugs Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
[Wireshark-bugs] [Bug 15707] Wireshark fails on piped/streamed pcapng packet capture data with mixed BE/LE SHBs, but reads mixed BE/LE files correctly
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15707 Guy Harris changed: What|Removed |Added Hardware|x86 |All -- You are receiving this mail because: You are watching all bug changes.___ Sent via:Wireshark-bugs mailing list Archives:https://www.wireshark.org/lists/wireshark-bugs Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
[Wireshark-bugs] [Bug 15707] Wireshark fails on piped/streamed pcapng packet capture data with mixed BE/LE SHBs, but reads mixed BE/LE files correctly
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15707 Guy Harris changed: What|Removed |Added Status|RESOLVED|CONFIRMED Ever confirmed|0 |1 Resolution|WONTFIX |--- --- Comment #15 from Guy Harris --- (In reply to TheDiveO from comment #14) > So this issue can be closed for good. Less clutter. :) No. It may not be fixed in the short term, but we might *eventually* support multi-section pcapng files, possibly including mixed-byte-order multi-section pcapng files - and add support for dumpcap being piped any file that Wireshark can read. -- You are receiving this mail because: You are watching all bug changes.___ Sent via:Wireshark-bugs mailing list Archives:https://www.wireshark.org/lists/wireshark-bugs Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
[Wireshark-bugs] [Bug 15707] Wireshark fails on piped/streamed pcapng packet capture data with mixed BE/LE SHBs, but reads mixed BE/LE files correctly
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15707 TheDiveO changed: What|Removed |Added Status|UNCONFIRMED |RESOLVED Resolution|--- |WONTFIX --- Comment #14 from TheDiveO --- So this issue can be closed for good. Less clutter. :) -- You are receiving this mail because: You are watching all bug changes.___ Sent via:Wireshark-bugs mailing list Archives:https://www.wireshark.org/lists/wireshark-bugs Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
[Wireshark-bugs] [Bug 15707] Wireshark fails on piped/streamed pcapng packet capture data with mixed BE/LE SHBs, but reads mixed BE/LE files correctly
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15707 --- Comment #13 from TheDiveO --- Thank you for clarifying! -- You are receiving this mail because: You are watching all bug changes.___ Sent via:Wireshark-bugs mailing list Archives:https://www.wireshark.org/lists/wireshark-bugs Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
[Wireshark-bugs] [Bug 15707] Wireshark fails on piped/streamed pcapng packet capture data with mixed BE/LE SHBs, but reads mixed BE/LE files correctly
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15707 --- Comment #12 from Gerrit Code Review --- Change 33198 had a related patch set uploaded by Guy Harris: Don't pretend we can handle multiple-section pcapng files when we can't. https://code.wireshark.org/review/33198 -- You are receiving this mail because: You are watching all bug changes.___ Sent via:Wireshark-bugs mailing list Archives:https://www.wireshark.org/lists/wireshark-bugs Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
[Wireshark-bugs] [Bug 15707] Wireshark fails on piped/streamed pcapng packet capture data with mixed BE/LE SHBs, but reads mixed BE/LE files correctly
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15707 --- Comment #11 from Guy Harris --- (In reply to TheDiveO from comment #8) > Do I correctly understand your analysis in that when using extcap/piping, > the machine capturing packets and the Wireshark machine needs to be both of > the same endianess? Is this correct? Yes. -- You are receiving this mail because: You are watching all bug changes.___ Sent via:Wireshark-bugs mailing list Archives:https://www.wireshark.org/lists/wireshark-bugs Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
[Wireshark-bugs] [Bug 15707] Wireshark fails on piped/streamed pcapng packet capture data with mixed BE/LE SHBs, but reads mixed BE/LE files correctly
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15707 --- Comment #10 from Guy Harris --- (In reply to Tomasz Mon from comment #4) > Could you please provide some mixed-endian pcapng file that contains some > actual data packets? ...because that probably won't work. The current code does *not* have support for multiple sections, even if they have the *same* endianness; it has only one per-file private data structure, not a set of per-segment structures attached to the per-file data structure, which is what would be needed to support multiple sections. It probably will report a corrupt file if you have multiple sections, with different byte orders, with packets in both sections; it will probably get even *more* badly confused if the two sections don't have the same lists of interfaces (if, for example, the first section has an "eth0" interface, with link type LINKTYPE_ETHERNET, and the second section has a "wlan0" interface, with link type LINKTYPE_IEEE802_11_RADIOTAP). -- You are receiving this mail because: You are watching all bug changes.___ Sent via:Wireshark-bugs mailing list Archives:https://www.wireshark.org/lists/wireshark-bugs Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
[Wireshark-bugs] [Bug 15707] Wireshark fails on piped/streamed pcapng packet capture data with mixed BE/LE SHBs, but reads mixed BE/LE files correctly
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15707 --- Comment #9 from Guy Harris --- (In reply to TheDiveO from comment #0) > - le-shb.pcapng: contains a single SHB in LE, with interface block also in > BE. Presumably meaning "also in LE", as running Wireshark in "Fileshark mode" (start Wireshark without a file, select File > Open, select "MIME Files Format", select the file and open), shows a little-endian ISB. -- You are receiving this mail because: You are watching all bug changes.___ Sent via:Wireshark-bugs mailing list Archives:https://www.wireshark.org/lists/wireshark-bugs Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
[Wireshark-bugs] [Bug 15707] Wireshark fails on piped/streamed pcapng packet capture data with mixed BE/LE SHBs, but reads mixed BE/LE files correctly
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15707 Guy Harris changed: What|Removed |Added Attachment #17066|contains a single SHB in|contains a single SHB in description|LE, with interface block|LE, with interface block |also in BE |also in LE -- You are receiving this mail because: You are watching all bug changes.___ Sent via:Wireshark-bugs mailing list Archives:https://www.wireshark.org/lists/wireshark-bugs Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
[Wireshark-bugs] [Bug 15707] Wireshark fails on piped/streamed pcapng packet capture data with mixed BE/LE SHBs, but reads mixed BE/LE files correctly
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15707 --- Comment #8 from TheDiveO --- Do I correctly understand your analysis in that when using extcap/piping, the machine capturing packets and the Wireshark machine needs to be both of the same endianess? Is this correct? -- You are receiving this mail because: You are watching all bug changes.___ Sent via:Wireshark-bugs mailing list Archives:https://www.wireshark.org/lists/wireshark-bugs Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
[Wireshark-bugs] [Bug 15707] Wireshark fails on piped/streamed pcapng packet capture data with mixed BE/LE SHBs, but reads mixed BE/LE files correctly
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15707 --- Comment #7 from Guy Harris --- (In reply to TheDiveO from comment #5) > The issue I see is that with Wireshark reading from the pipe it has given an > extcap plugin, Wireshark already fails with an error message as soon as it > sees the second LE SHB after the first BE SHB, even before it sees any > captured packets. I know this from inspecting the data send by a remote > dumpcap on a rather very idle network interface, so I only got the LE SHB > but no packet data, and handing that over to Wireshark made it already fail. Perhaps extcap doesn't have the bug 15754 problem, but has the mixed-endian problem. -- You are receiving this mail because: You are watching all bug changes.___ Sent via:Wireshark-bugs mailing list Archives:https://www.wireshark.org/lists/wireshark-bugs Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
[Wireshark-bugs] [Bug 15707] Wireshark fails on piped/streamed pcapng packet capture data with mixed BE/LE SHBs, but reads mixed BE/LE files correctly
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15707 --- Comment #6 from Guy Harris --- At least part of the problem is that 1) x86 is little-endian and 2) we don't support piping byte-swapped pcapng (or pcap, I suspect) files to dumpcap so you can't pipe big-endian files to pcapng on x86 (32-bit or 64-bit) or other little-endian systems - and can't pipe little-endian files to pcapng on SPARC, z/Architecture, big-endian PowerPC, or other big-endian systems, as per bug 15754. -- You are receiving this mail because: You are watching all bug changes.___ Sent via:Wireshark-bugs mailing list Archives:https://www.wireshark.org/lists/wireshark-bugs Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
[Wireshark-bugs] [Bug 15707] Wireshark fails on piped/streamed pcapng packet capture data with mixed BE/LE SHBs, but reads mixed BE/LE files correctly
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15707 Guy Harris changed: What|Removed |Added See Also||https://bugs.wireshark.org/ ||bugzilla/show_bug.cgi?id=15 ||754 -- You are receiving this mail because: You are watching all bug changes.___ Sent via:Wireshark-bugs mailing list Archives:https://www.wireshark.org/lists/wireshark-bugs Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
[Wireshark-bugs] [Bug 15707] Wireshark fails on piped/streamed pcapng packet capture data with mixed BE/LE SHBs, but reads mixed BE/LE files correctly
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15707 Tomasz Mon changed: What|Removed |Added Component|Capture file support|Dumpcap |(libwiretap)| -- You are receiving this mail because: You are watching all bug changes.___ Sent via:Wireshark-bugs mailing list Archives:https://www.wireshark.org/lists/wireshark-bugs Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
[Wireshark-bugs] [Bug 15707] Wireshark fails on piped/streamed pcapng packet capture data with mixed BE/LE SHBs, but reads mixed BE/LE files correctly
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15707 --- Comment #5 from TheDiveO --- The issue I see is that with Wireshark reading from the pipe it has given an extcap plugin, Wireshark already fails with an error message as soon as it sees the second LE SHB after the first BE SHB, even before it sees any captured packets. I know this from inspecting the data send by a remote dumpcap on a rather very idle network interface, so I only got the LE SHB but no packet data, and handing that over to Wireshark made it already fail. -- You are receiving this mail because: You are watching all bug changes.___ Sent via:Wireshark-bugs mailing list Archives:https://www.wireshark.org/lists/wireshark-bugs Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
[Wireshark-bugs] [Bug 15707] Wireshark fails on piped/streamed pcapng packet capture data with mixed BE/LE SHBs, but reads mixed BE/LE files correctly
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15707 --- Comment #4 from Tomasz Mon --- Could you please provide some mixed-endian pcapng file that contains some actual data packets? -- You are receiving this mail because: You are watching all bug changes.___ Sent via:Wireshark-bugs mailing list Archives:https://www.wireshark.org/lists/wireshark-bugs Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
[Wireshark-bugs] [Bug 15707] Wireshark fails on piped/streamed pcapng packet capture data with mixed BE/LE SHBs, but reads mixed BE/LE files correctly
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15707
Tomasz Mon changed:
What|Removed |Added
CC||deso...@gmail.com
--- Comment #3 from Tomasz Mon ---
I have tried following commands on Windows 10 x64:
cat le-shb.pcapng | Wireshark -k -i -
cat be-shb.pcapng | Wireshark -k -i -
cat bele-shbs.pcapng | Wireshark -k -i -
and noticed that le-shb.pcapng works fine ("No packets captured" information
box appears), while the be-shb.pcapnp and bele-shbs.pcapng result in
"Unrecognized pcapng format or not pcapng data."
After reading the issue description I got an impression that both le-shb.pcapnp
and be-shb.pcapng should work just fine. Did I misunderstand it? Or does the
cat into Wireshark stdin give different result than when extcap streams that
data?
--
You are receiving this mail because:
You are watching all bug changes.___
Sent via:Wireshark-bugs mailing list
Archives:https://www.wireshark.org/lists/wireshark-bugs
Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs
mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
[Wireshark-bugs] [Bug 15707] Wireshark fails on piped/streamed pcapng packet capture data with mixed BE/LE SHBs, but reads mixed BE/LE files correctly
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15707 --- Comment #2 from TheDiveO --- Created attachment 17068 --> https://bugs.wireshark.org/bugzilla/attachment.cgi?id=17068&action=edit first SHB is BE, second SHB is LE. -- You are receiving this mail because: You are watching all bug changes.___ Sent via:Wireshark-bugs mailing list Archives:https://www.wireshark.org/lists/wireshark-bugs Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
[Wireshark-bugs] [Bug 15707] Wireshark fails on piped/streamed pcapng packet capture data with mixed BE/LE SHBs, but reads mixed BE/LE files correctly
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=15707 --- Comment #1 from TheDiveO --- Created attachment 17067 --> https://bugs.wireshark.org/bugzilla/attachment.cgi?id=17067&action=edit contains a single SHB in BE, no interface block -- You are receiving this mail because: You are watching all bug changes.___ Sent via:Wireshark-bugs mailing list Archives:https://www.wireshark.org/lists/wireshark-bugs Unsubscribe: https://www.wireshark.org/mailman/options/wireshark-bugs mailto:wireshark-bugs-requ...@wireshark.org?subject=unsubscribe
