From d3a2da73e3aa3c913fb7f4a4e5734b02a53f489b Mon Sep 17 00:00:00 2001 From: Alban Browaeys Date: Wed, 15 Mar 2017 19:36:35 +0100 Subject: [PATCH] snaplen cannot exceed max 262144 to open it wiht pcap As report in : https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=846241 bustle fails to load the dumps it creates with: hGetContents: invalid argument (invalid byte sequence) Adding trace in pcap binding I get this error from pcap at this time: invalid file capture length 134217728, bigger than maximum of 262144 bustle set snaplen to "1 << 27" that is 134217728, in its call to pcap_open_dead to setup the pcap_t structure. Then when it attempts to load such dumps, libpcap errors out on spanlen and the error is badly handled thus the above misleading error message. --- c-sources/pcap-monitor.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/c-sources/pcap-monitor.c b/c-sources/pcap-monitor.c index 0a19d96..f74cca9 100644 --- a/c-sources/pcap-monitor.c +++ b/c-sources/pcap-monitor.c @@ -433,7 +433,7 @@ initable_init ( return FALSE; } - priv->p = pcap_open_dead (DLT_DBUS, 1 << 27); + priv->p = pcap_open_dead (DLT_DBUS, 65535); if (priv->p == NULL) { g_set_error (error, G_IO_ERROR, G_IO_ERROR_FAILED, -- 2.11.0