TraceWrangler has some limitations at the moment (which may most likely last a little longer than just "a moment"):

  • The maximum trace file size is less than 2GBytes per capture file added to the file list. This limitation is a result of the way the files are read by using Memory Mapped files. I'll work on this "when there is time"tm.
  • Capture files that contain truncated or damaged frames may not work under all circumstances. I recommend using captures that contain full sized frames. Reason for this is that I may have been lazy in some parts of the code where I do sanity checks against the length of the data available for processing, which is a great way to run some pointers into the great beyond. Ouch.
  • IPv6 checksums may not be calculated correctly when extension headers (including fragmentation headers) are used in a frame.