This is a request to have a use flag to enable large file support in Wireshark. Wireshark by default builds (at least on x86) with 32-bit file offsets, limiting it to about 2GB files. It is very easy to get a capture file that is far larger than this. Enabling the support is very easy, and at least in my testing works well.
Here's a diff to the ebuild that allows for 64-bit file offset support. I don't know if largefile would be the preferred USE flag, but it's an example: Also I don't know if both flags are needed or just one. --- /usr/portage/net-analyzer/wireshark/wireshark-0.99.5.ebuild 2007-04-18 08:05:53.000000000 -0400 +++ wireshark-0.99.5.ebuild 2007-04-27 10:32:09.000000000 -0400 @@ -11,7 +11,7 @@ LICENSE="GPL-2" SLOT="0" KEYWORDS="alpha amd64 hppa ia64 ppc ppc64 sparc x86 ~x86-fbsd" -IUSE="adns gtk ipv6 portaudio snmp ssl kerberos threads selinux" +IUSE="adns gtk ipv6 largefile portaudio snmp ssl kerberos threads selinux" RDEPEND="sys-libs/zlib snmp? ( net-analyzer/net-snmp ) @@ -69,6 +69,11 @@ replace-flags -O? -O fi + if use largefile; then + elog "Enabling >2GB file support" + append-flags -D_LARGEFILE_SOURCE -D_FILE_OFFSET_BITS=64 + fi + # see bug #133092 filter-flags -fstack-protector
http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=580 http://bugs.wireshark.org/bugzilla/show_bug.cgi?id=1190 Looks like upstream is working on 64 bit offsets and getting it going. I'd like to wait until it has been tested preferably with some autoconf AC_SYS_LARGEFILE tests before enabling an option that may cause problems with for the OS. Thanks for your interest though. Its a good idea.
