Handling Corrupted Packets Inside Pcap Files?

[Hei Chan]

Hi,
The first 3 packets are corrupted according to wireshark.

As soon as I read the first packet with pcap_next(), my application gets a coredump.

Is it an expected behavior?

If not, what's the correct/better usage to get around it?

Thanks in advance.


Cheers,
Hei

P.S. I am using libpcap 1.4.0 if it matters.

[Guy Harris]

Post by Hei Chan
Hi,
The first 3 packets are corrupted according to wireshark.

What is the exact message Wireshark reports?

Can you send us the pcap file or make it available for downloading?

Post by Hei Chan
As soon as I read the first packet with pcap_next(), my application gets a coredump.

Is it crashing in pcap_next(), or is it crashing in your application's code?

Could we see your application's code?

If it's crashing in pcap_next(), what is the stack trace from the crash?