[Wireshark-bugs] [Bug 16531] pcapng with multiple sections: packets from later sections use first section's interfaces

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16531 --- Comment #7 from David Perry --- I forgot to mention in comment #4 that the issue in comment #1 seems to have been addressed by the fixes. Wireshark no longer complains that with_snaplen_multi.pcapng is corrupt. (Error messages jump out

[Wireshark-bugs] [Bug 16531] pcapng with multiple sections: packets from later sections use first section's interfaces

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16531 --- Comment #6 from David Perry --- (In reply to Guy Harris from comment #5) > That's why the bug is still open. My comment seems to have been taken as something other than a simple update. Is there a better way I can provide updates of t

[Wireshark-bugs] [Bug 16531] pcapng with multiple sections: packets from later sections use first section's interfaces

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16531 Guy Harris changed: What|Removed |Added OS|Linux |All Hardware|x86-64

[Wireshark-bugs] [Bug 16531] pcapng with multiple sections: packets from later sections use first section's interfaces

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16531 --- Comment #5 from Guy Harris --- (In reply to David Perry from comment #4) > The work from change 36985, and other changes since reporting this issue, > has partly but incompletely addressed this bug. That's why the bug is still open.

[Wireshark-bugs] [Bug 16531] pcapng with multiple sections: packets from later sections use first section's interfaces

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16531 --- Comment #4 from David Perry --- The work from change 36985, and other changes since reporting this issue, has partly but incompletely addressed this bug. When I test with master (v3.3.0rc0-1712-g8c0c27e59086) on the two attached pcaps

[Wireshark-bugs] [Bug 16531] pcapng with multiple sections: packets from later sections use first section's interfaces

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16531 --- Comment #3 from Gerrit Code Review --- Change 36985 had a related patch set uploaded by Guy Harris: pcapng: have per-section interface tables rather than per-file. https://code.wireshark.org/review/36985 -- You are receiving this ma

[Wireshark-bugs] [Bug 16531] pcapng with multiple sections: packets from later sections use first section's interfaces

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16531 --- Comment #2 from Guy Harris --- It also uses the first section's byte order. Note that, to determine, in the *random* read routine, which section you're in, you will need to mark each section with the block offset in the file of its SH

[Wireshark-bugs] [Bug 16531] pcapng with multiple sections: packets from later sections use first section's interfaces

https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=16531 --- Comment #1 from David Perry --- Created attachment 17740 --> https://bugs.wireshark.org/bugzilla/attachment.cgi?id=17740&action=edit Fabricated PcapNG file with two SHBs, and different snap lengths Here is a second example capture f