Actions
Bug #469
closedlog-pcap: creates malformed files
Affected Versions:
Effort:
Difficulty:
Label:
Description
wiresharks capinfos:
File type: Wireshark/tcpdump/... - libpcap File encapsulation: Ethernet Packet size limit: file hdr: 1518 bytes Number of packets: 572419 File size: 532291419 bytes Data size: 523132691 bytes Capture duration: 77 seconds Start time: Wed May 23 12:02:36 2012 End time: Wed May 23 12:03:53 2012 Data byte rate: 6774346.51 bytes/sec Data bit rate: 54194772.07 bits/sec Average packet size: 913.90 bytes Average packet rate: 7412.58 packets/sec SHA1: d6ba37bd8db39fa8bf18786ef0a5d30b1eafcef1 RIPEMD160: e506dace694471265b15aa2d915dbf7922940e6e MD5: 9c2ea0238bd07b998cfdc045d5d8d87d Strict time order: False
However, Suricata gets only:
[26952] 23/5/2012 -- 12:11:05 - (tm-threads.c:1858) <Info> (TmThreadWaitOnThreadInit) -- all 7 packet processing threads, 3 management threads initialized, engine started. [26966] 23/5/2012 -- 12:11:05 - (source-pcap-file.c:187) <Error> (ReceivePcapFileLoop) -- [ERRCODE: SC_ERR_PCAP_DISPATCH(20)] - error code -1 truncated dump file; tried to read 1514 captured bytes, only got 962 [26966] 23/5/2012 -- 12:11:06 - (source-pcap-file.c:282) <Info> (ReceivePcapFileThreadExitStats) -- Pcap-file module read 63 packets, 63526 bytes
tshark also only reads 63 packets.
Updated by Victor Julien over 12 years ago
- Target version deleted (
1.3beta2)
Have not been able to reproduce this any further.
Updated by Victor Julien about 12 years ago
- Status changed from Assigned to Closed
Haven't seen this anymore.
Actions