PcapSplitter: Max. Bytes per File limited to 1.9 Gbyte

[pjattke]

The total size per files uses an int to store the given parameter value. As the maximum value of an int is limited to 2,147,483,647, the largest max. bytes per file is 1.99 Gbyte. I know that this is just an example, but as the latest release contains the PcapSplitter as binary it also does a great job as an standalone utility. Therefore I would suggest adapting the PcapSplitter to support splitting into larger files.

I am looking into this because I need a splitting by file size and tcpdump, editcap and other tools, have the same limitation or do not provide splitting by file size at all. Would someone be so kind to tell me which customization is required to make this work? Thanks a lot!

[seladb]

I can do that fix for you, it shouldn't be too difficult. How urgent is it for you? Do you also want me to create a new build (depends on the operating system you need to use it on)?

[pjattke]

@seladb Thanks a lot for your offered help! It looks like tcpdump suffers by a similar issue. However, someone posted the required changes such that I could apply them to my cloned repo, I recompiled it and now I finally could split my large (~14 GB) PCAP files.

[seladb]

Issue was fixed, you can pull the latest code, compile PcapSplitter and use it