Tcpdump: invalid file capture length 33554392, bigger than maximum of 262144 User f26 $ tcpdump -r bad-pcap-replay.pcap * 1) big enough for maximum-size Linux loopback packets (65549) I did a quick check of the libpcap source code and this seems like a work for upstream, because they specify the maximum value directly in the source code: Googling suggests that there was a documentation change in 2015 to change the default value from 64K to 256K. tcpreplay -i -x 100.0 bad-pcap-replay.pcapįailed: Error opening pcap file: invalid file capture length 33554392, bigger than maximum of 262144Īctual: 73337 packets (7790535 bytes) sent in 3.01 seconds. Under earlier versions of the library, it will work just fine. Attempt to tcpreplay or editcap or mergecap the file. Version-Release number of selected component (if applicable):Ĭreate a pcap file with snaplen > 262144 (example file in the attached tarball). This should not be a fatal error, as it's for instance a common use case for traffic capture using memory-mapped files. In earlier versions these files would open without any issue.

If libpcap1.8 encounters a pcap file with the snaplen specified as larger than the default value of 262144 bytes, it refuses to open it.

Fedora core 8 packet capture software