Project

General

Profile

Actions
Copy link

Bug #469

closed

log-pcap: creates malformed files

Added by Victor Julien almost 12 years ago. Updated over 11 years ago.

Status:
Closed
Priority:
Normal
Assignee:
Victor Julien
Target version:
1.4
Affected Versions:
Effort:
Difficulty:
Label:

Description

wiresharks capinfos:

File type:           Wireshark/tcpdump/... - libpcap
File encapsulation:  Ethernet
Packet size limit:   file hdr: 1518 bytes
Number of packets:   572419
File size:           532291419 bytes
Data size:           523132691 bytes
Capture duration:    77 seconds
Start time:          Wed May 23 12:02:36 2012
End time:            Wed May 23 12:03:53 2012
Data byte rate:      6774346.51 bytes/sec
Data bit rate:       54194772.07 bits/sec
Average packet size: 913.90 bytes
Average packet rate: 7412.58 packets/sec
SHA1:                d6ba37bd8db39fa8bf18786ef0a5d30b1eafcef1
RIPEMD160:           e506dace694471265b15aa2d915dbf7922940e6e
MD5:                 9c2ea0238bd07b998cfdc045d5d8d87d
Strict time order:   False

However, Suricata gets only:

[26952] 23/5/2012 -- 12:11:05 - (tm-threads.c:1858) <Info> (TmThreadWaitOnThreadInit) -- all 7 packet processing threads, 3 management threads initialized, engine started.
[26966] 23/5/2012 -- 12:11:05 - (source-pcap-file.c:187) <Error> (ReceivePcapFileLoop) -- [ERRCODE: SC_ERR_PCAP_DISPATCH(20)] - error code -1 truncated dump file; tried to read 1514 captured bytes, only got 962
[26966] 23/5/2012 -- 12:11:06 - (source-pcap-file.c:282) <Info> (ReceivePcapFileThreadExitStats) -- Pcap-file module read 63 packets, 63526 bytes

tshark also only reads 63 packets.

Actions
Copy link

Also available in: Atom PDF