Sigh. Tcpdump cannot handle capture files with a snapshot length of 0,

as BPF filters return either 0 if they fail or the snapshot length if
they succeed, and a snapshot length of 0 means success is
indistinguishable from failure and the filter expression would reject
all packets.

Now that a snapshot length of 0, inside Ethereal, means "snapshot length
unknown", we have to, when opening a libpcap file for output, make the
snapshot length some non-zero value.  We make it WTAP_MAX_PACKET_SIZE,
in case some program uses the snapshot length as a buffer size.  (That
doesn't help if there are packets with more than 65535 bytes of data; if
there are, we'd need to raise WTAP_MAX_PACKET_SIZE just to make those
files readable in Ethereal in any case.)

svn path=/trunk/; revision=4905

0 files changed, 0 insertions, 0 deletions