I have tcpslice from ports. I have two files of 95 megabytes in size created by FreeBSD's own tcpdump. I try to "tcpslice -w file3.pcap 9h25m 10h10m file1.pcap file2.pcap" ... and tcpslice just says it can't find the final packet. I git clone from https://github.com/the-tcpdump-group/tcpslice and ./configure + make + make install ... and tcpslice works.
Created attachment 214510 [details] patch My cybersecurity guys complained about this issue; here's my fix. The symptom is: tcpslice: problems finding end packet of file ... This is because pcap-int.h is not found while building. This comment from search.c explains the complication: /* If we're building without pcap's internal headers, we have to just * assume that the public pcap_pkthdr is the same as is written to * the file. This can cause problems on systems with 64-bit longs; * the symptom is that tcpslice can't find any packets to read. * The solution is to build with the pcap-int.h from the installed * version of libpcap. */ So adding -I${SRC_BASE}/contrib/libpcap to CPPFLAGS allows usage of pcap-int.h. But a patch to search.c is also needed due to the unfortunately ordering of includes (libpcap has some portability that pcap-int.h invokes that doesn't work if its invoked before string.h is included). Here's the upstream pull request: https://github.com/the-tcpdump-group/tcpslice/pull/6 Happy to commit with maintainer approval.
Created attachment 214535 [details] revised patch My pull request prompted a rewrite of some parts of tcpslice; the new version does not depend on pcap-int.h. Here's a revised patch to just update to the version committed yesterday.
A commit references this bug: Author: leres Date: Wed Jul 22 00:23:27 UTC 2020 New revision: 542820 URL: https://svnweb.freebsd.org/changeset/ports/542820 Log: net/tcpslice: Update to solve "problems finding end packet of file" error tcpslice was a 2014 version that required an internal header file (pcap-int.h) to fully support systems with 64-bit longs. After I filed an issue with upstream the code was rewritten to eliminate this dependency; update to this version. PR: 243522 Approved by: sbz (maintainer timeout, 9 weeks) Changes: head/net/tcpslice/Makefile head/net/tcpslice/distinfo
It should have been closed after r542820. Also I landed a update to latest version in r569431. Thanks!