From b28b07379fe966f0a89ead9fe2fa30ac05e19e9c Mon Sep 17 00:00:00 2001 From: Jaap Keuter Date: Tue, 7 Feb 2017 23:35:50 +0100 Subject: editcap: handle too short frames in frame comparison With option -I one can ignore the first number of bytes from the frame while doing duplicate frame removal. This doesn't handle shorter frames correctly. Add safeguards for this, and update the help text. Bug: 13378 Change-Id: Ia6b65d0797f4069f0b89fa134114d88d80988211 Reviewed-on: https://code.wireshark.org/review/20004 Petri-Dish: Peter Wu Tested-by: Petri Dish Buildbot Reviewed-by: Peter Wu --- doc/editcap.pod | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) (limited to 'doc') diff --git a/doc/editcap.pod b/doc/editcap.pod index a122332f1d..0eff2c943d 100644 --- a/doc/editcap.pod +++ b/doc/editcap.pod @@ -178,9 +178,10 @@ opened. The default is to use a single output file. =item -I Ebytes to ignoreE -Ignore the specified bytes number at the beginning of the frame during MD5 hash calculation -Useful to remove duplicated packets taken on several routers(differents mac addresses for example) -e.g. -I 26 in case of Ether/IP/ will ignore ether(14) and IP header(20 - 4(src ip) - 4(dst ip)). +Ignore the specified number of bytes at the beginning of the frame during MD5 hash calculation, +unless the frame is too short, then the full frame is used. +Useful to remove duplicated packets taken on several routers (different mac addresses for example) +e.g. -I 26 in case of Ether/IP will ignore ether(14) and IP header(20 - 4(src ip) - 4(dst ip)). The default value is 0. =item -L -- cgit v1.2.1