[Click] FromDump and LARGE files...

[Eddie Kohler]

Can tcpdump process that file?  Click is known to work on very large pcap 
files, but very large pcap files can get corrupted...

Eddie


Nicholas Weaver wrote:
> 	Has anyone else had a problem with FromDump and large files?
> 
> nweaver at clicknode1:/tmp> ls -l munge1600.tcpdump 
> -rw-r--r--    1 nweaver  eWorm    1035360024 Jul 11 12:56 munge1600.tcpdump
> 
> is locking up on me with only a few packets sent.  But a file 1/2 the
> size works fine.  Is this known?  Or is it something else that is the
> problem?
> 
> Thanks.
> 
> FromDump($FROM)
>         -> only_ip :: Classifier(12/0800, -)
>         -> Strip(14)
>         -> EtherEncap(0x0800, 1:1:1:1:1:1, 2:2:2:2:2:2) 
>         -> CheckIPHeader(14)
>         -> lb :: LoadBalanceSimple($MAC,
>                              0xcafebabefeedface,
> 00:04:23:C5:D7:8E,
> 00:04:23:C5:DE:92,
> 00:04:23:C7:A3:14,
> 00:04:23:C5:E0:4A,
> 00:04:23:C5:D4:72,
> 00:04:23:C5:DC:BC,
> 00:04:23:C7:A8:1E,
> 00:04:23:C7:A8:F6,
> 00:04:23:C7:A8:32,
> 00:04:23:C5:D5:32,
> 00:04:23:C7:A9:F4,
> 00:04:23:C7:A8:14,
> 00:04:23:C7:A6:34,
> 00:04:23:C7:A7:8C,
> 00:04:23:C7:A8:1A,
> 00:04:23:C7:A8:0A
> )
>         -> Queue(4000000)
>         -> Shaper($SIZE)
>         -> c::Counter()
>         -> ToDevice(eth0);
> 
> only_ip[1] -> Discard();
> 
>