OPNsense Forum

English Forums => General Discussion => Topic started by: dave on August 20, 2019, 07:40:16 pm

Title: Corrupt cap files
Post by: dave on August 20, 2019, 07:40:16 pm

Hi,

Whenever I leave an interface capture running for any amount of time, Wireshark reports the following when I open the file:

"The capture file appears to be damaged or corrupt.
(pcap: File has 992550946-byte packet, bigger than maximum of 262144)"

Is this because I'm leaving the capture running for a long time, or something else?
Looking around Google a lot of people mention it could be to do with the transfer method, but I just downloaded the file via the GUI.

Thanks.

Title: Re: Corrupt cap files
Post by: fabian on August 20, 2019, 10:38:47 pm

This means that a packet has a broken header.

Title: Re: Corrupt cap files
Post by: dave on September 15, 2019, 03:15:03 pm

It certainly looks like something's happening here.
No matter the size or duration of the capture, when transferred via SSH everything's fine; when downloaded via the GUI things end up broken.

Title: Re: Corrupt cap files
Post by: franco on September 16, 2019, 04:01:48 pm

Please try this patch: https://github.com/opnsense/core/commit/5d4599e

# opnsense-patch 5d4599e


Cheers,
Franco

Title: Re: Corrupt cap files
Post by: franco on September 29, 2019, 03:17:37 pm

I cannot stress enough how vital feedback is in order to be able to ship tested patches. ;)


Cheers,
Franco

Title: Re: Corrupt cap files
Post by: dave on September 29, 2019, 06:17:31 pm

point taken

Title: Re: Corrupt cap files
Post by: franco on September 30, 2019, 09:01:53 pm

So, does it work or same error?

Title: Re: Corrupt cap files
Post by: dave on September 30, 2019, 10:35:37 pm

dude, gaming!

Title: Re: Corrupt cap files
Post by: dave on September 30, 2019, 11:01:19 pm

Having applied the patch the GUI download never starts, but can still be transfered fine via scp.
Applied the patch again to remove it and the GUI download started working again.
Tested with a ~300MB capture.

Seams to have generated a bug report too:

Code: [Select]

[30-Sep-2019 21:58:07 Europe/London] PHP Fatal error:  Allowed memory size of 402653184 bytes exhausted (tried to allocate 344058472 bytes) in /usr/local/www/diag_packet_capture.php on line 165
[30-Sep-2019 21:58:07 Europe/London] PHP Fatal error:  Unknown: Cannot use output buffering in output buffering display handlers in Unknown on line 0
[30-Sep-2019 21:58:40 Europe/London] PHP Fatal error:  Allowed memory size of 402653184 bytes exhausted (tried to allocate 344058472 bytes) in /usr/local/www/diag_packet_capture.php on line 165
[30-Sep-2019 21:58:40 Europe/London] PHP Fatal error:  Unknown: Cannot use output buffering in output buffering display handlers in Unknown on line 0