When processing pcap (Files captured with libpcap, E.g. tcpdump or whireshark) there are errors that can occur.
Damaged or incomplete pcap files
Error
Error in TFileReader.ProcessFile(/opt/datatex/siprecord2/incoming/skywire220240204_080054.pcap): Error in /opt/datatex/siprecord2/temp/skywire220240204_080054.pcap at packet 18162: len > remaining file: 2772981 + 74 > 2772992
Error explained
- This error states the file that was processed:
/opt/datatex/siprecord2/incoming/skywire220240204_080054.pcap - It states that the error occurred on packet
18162. - The size of the file at the point where this packet is starting is given as
2772981 - The size of the failing packet is given as
74. - The actual size of the file is given as
2772992 - If the packet of 74 bytes is added to the 2772981 the size should be 2773055. There are 63 missing bytes from the file.
This can happen for a couple of reasons.
- The capture was stopped before the file was written out.
- The server ran out of space and there was not space to write the last couple of bytes.
- the server was rebooted while it was still writing and didn’t complete.
Results
- The Siprecorder usually will skip over this and continue to the next file.
- A ticket will be created to indicate that this happened.
- Usually after a server reboot you should get one of these tickets.
- If you are getting repeated errors, there may be a disk space issue and multiple files are affected. Disk space issues must be addressed immediately, or recordings will be affected.