Custom Query (89 matches)

I cannot use tracemerge to join two files that were generated from tracesplit. I get a segfault resulting in the following backtrace

Program received signal SIGSEGV, Segmentation fault.
0x00002afa73868125 in fwrite () from /lib/libc.so.6
(gdb) bt full
#0  0x00002afa73868125 in fwrite () from /lib/libc.so.6
No symbol table info available.
#1  0x00002afa73b5ad3d in pcap_dump () from /usr/lib/libpcap.so.0.8
No symbol table info available.
#2  0x00002afa736fde6f in pcap_write_packet (libtrace=0x502010,
    packet=0x532f70) at format_pcap.c:327
        pcap_pkt_hdr = {ts = {tv_sec = 0, tv_usec = 47255166863944},
  caplen = 0, len = 0}
        __PRETTY_FUNCTION__ = "pcap_write_packet"
#3  0x00002afa736f972f in trace_write_packet (libtrace=0x502010,
    packet=0x532f70) at trace.c:706
        __PRETTY_FUNCTION__ = "trace_write_packet"
#4  0x00000000004011ce in main (argc=5, argv=0x7fffff835b98)
    at tracemerge.c:128
        oldest_ts = 4934733062320447758
        oldest = 1
        output = (struct libtrace_out_t *) 0x502010
        input = (struct libtrace_t **) 0x502140
        packet = (struct libtrace_packet_t **) 0x5021a0
        live = (_Bool *) 0x5021c0
        set_interface = true
        unique_packets = false
        i = 3
        last_ts = 0

When using the -i option in conjunction with a PCAP input trace and ERF output traces an error occurs as shown below.

matt@argon:~$ tracemerge -i erf:new.erf pcap:out.pcap pcap:in.pcap
trace_write_packet((null)): No erf type for packet

The problem occurs because when trace_set_direction is set on a packet read from a pcap trace the packet is promoted to the LINUX_SLL type. This type is not handled by the erf output routines, libtrace_to_erf_type in linktypes.c particularly, leading to the error shown above.

The *.protocol files in libpacketdump are removed when make clean is run. This prevents them from being included in the distribution tarball generated by make dist.

I'm assuming these files are meant to be included given that a make install from the working directory installs them.