0

Is there a maximum amount of packets for pcap file (beyond OS limits?

Looking at the specification I don't see anything in the pcap file format that would limit the number of packets.

Perhaps will libpcap or tcpdump limit the number of packets written?

RyPeck
  • 7,830
  • 3
  • 38
  • 58
  • None I know about, just limited by file size handled by the system. And as it is just appending data while capturing, the size shouldn't limit it either. – vonbrand Feb 18 '13 at 21:15

1 Answers1

1

No, there is nothing in the pcap file format that limits the number of packets in a file. (The pcap-ng file format allows a maximum of 18446744073709551614 bytes in a section, if the Section Header Block must contain the number of bytes in a section, but, with more than 18446744073709551615 bytes in a file, even current 64-bit operating systems will have a problem with the file. :-))

Tcpdump just uses libpcap to write out files, so it would be limited only by libpcap's limitations.

libpcap 1.0 and later uses the AC_SYS_LARGEFILE macro in the configure script, so, on UN*X, if the underlying operating system supports files larger than 2GB (which they should all do for 64-bit machines, and which most if not all of them have done for several years on 32-bit machines), and if the configure script properly sets things up on 32-bit machines to allow large files (or if no such setup is necessary - it's not necessary on *BSD and OS X, for example), and if whoever built the library didn't somehow prevent that from working, libpcap should have no problem writing files larger than 2GB (as long as you have enough disk space, of course...).

I don't know whether the C support library that comes with whatever compiler was used to build WinPcap will support large files on Windows NT (NT 3.x, NT 4.0, 2000, XP, Vista, 7, 8, and various Server versions), but I suspect it would. I don't think Windows OT (95, 98, Me) supports large files.