[Coral-dev] Large File Support and EOVERFLOW

[Fletcher Mattox]

Hi,

When the coral utilities try to read a tcpdump trace greater than 2GB,
they seem to get EOVERFLOW

  $ ls -l boom
  -rw-r--r--  1 root root 6359908352 May 10 10:20 boom
  $ file boom
  boom: tcpdump capture file (little-endian) - version 2.4 (Ethernet, capture length 96)
  $ crl_to_pcap boom
  coral_open: boom: stat: Value too large for defined data type
  $ 

I say "seem" to get EOVERFLOW because if I run the process under a debugger,
the open(2) and stat(2) clearly succeed.  They return a 0 with the stat
buffer filled in correctly (I think).

So why does crl_to_pcap fail?
And how can I use these tools on large tcpdump trace files?
Surely this problem has come up before?

Oh.  I'm using breezy badger ubuntu linux, if it matters.

  $ uname -a
  Linux zadie.cs.utexas.edu 2.6.13.2 #9 SMP Mon Oct 3 08:33:17 CDT 2005 i686 unknown unknown GNU/Linux
  $ 

Thanks,
Fletcher