Corrupt cap files

[dave]

Hi,

Whenever I leave an interface capture running for any amount of time, Wireshark reports the following when I open the file:

"The capture file appears to be damaged or corrupt.
(pcap: File has 992550946-byte packet, bigger than maximum of 262144)"

Is this because I'm leaving the capture running for a long time, or something else?
Looking around Google a lot of people mention it could be to do with the transfer method, but I just downloaded the file via the GUI.

Thanks.

[fabian]

This means that a packet has a broken header.

[dave]

It certainly looks like something's happening here.
No matter the size or duration of the capture, when transferred via SSH everything's fine; when downloaded via the GUI things end up broken.

[franco]

Please try this patch: https://github.com/opnsense/core/commit/5d4599e

# opnsense-patch 5d4599e


Cheers,
Franco

[franco]

I cannot stress enough how vital feedback is in order to be able to ship tested patches.


Cheers,
Franco

[dave]

point taken

[franco]

So, does it work or same error?

[dave]

dude, gaming!

[dave]

Having applied the patch the GUI download never starts, but can still be transfered fine via scp.
Applied the patch again to remove it and the GUI download started working again.
Tested with a ~300MB capture.

Seams to have generated a bug report too:

Code: [Select]

[30-Sep-2019 21:58:07 Europe/London] PHP Fatal error:  Allowed memory size of 402653184 bytes exhausted (tried to allocate 344058472 bytes) in /usr/local/www/diag_packet_capture.php on line 165
[30-Sep-2019 21:58:07 Europe/London] PHP Fatal error:  Unknown: Cannot use output buffering in output buffering display handlers in Unknown on line 0
[30-Sep-2019 21:58:40 Europe/London] PHP Fatal error:  Allowed memory size of 402653184 bytes exhausted (tried to allocate 344058472 bytes) in /usr/local/www/diag_packet_capture.php on line 165
[30-Sep-2019 21:58:40 Europe/London] PHP Fatal error:  Unknown: Cannot use output buffering in output buffering display handlers in Unknown on line 0