# cannot read large pcap file

**URL:** <https://community.zeek.org/t/cannot-read-large-pcap-file/935>\
**Category:** Zeek\
**Created:** [March 6, 2006, 3:17pm UTC](https://community.zeek.org/t/cannot-read-large-pcap-file/935 "2006-03-06T15:17:54Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Jay\_Hwang](https://avatars.discourse-cdn.com/v4/letter/j/e95f7d/32.png) [@Jay\_Hwang](https://community.zeek.org/u/Jay_Hwang)\
**Post date:** [March 6, 2006, 3:17pm UTC](https://community.zeek.org/t/cannot-read-large-pcap-file/935/1 "2006-03-06T15:17:54Z")

</div>

Hi, I want to run bro with 300GB pcap file but it cannot run

[jhwhang@wien:~/bro-0.9a11$](mailto:jhwhang@wien:~/bro-0.9a11%24) bro -r ~/jh/20051107\_2200\_2h\_Rx.pcap.2  
bro: problem with trace file /home/jhwhang/jh/20051107\_2200\_2h\_Rx.pcap.2 - /home/jhwhang/jh/20051107\_2200\_2h\_Rx.pcap.2: File too large

I tried

./configure --prefix=/home/jhwhang/gb/bro/ --enable-largefile

and

CFLAGS=-D\_\_USE\_LARGEFILE64 ./configure --prefix=/home/jhwhang/gb/bro/ --enable-largefile

but both didn’t work

How can I do?

---

<div class="post-metadata">

**Author:** ![Christian\_Kreibich3](https://avatars.discourse-cdn.com/v4/letter/c/4af34b/32.png) [@Christian\_Kreibich3](https://community.zeek.org/u/Christian_Kreibich3)\
**Post date:** [March 6, 2006, 4:17pm UTC](https://community.zeek.org/t/cannot-read-large-pcap-file/935/2 "2006-03-06T16:17:33Z")

</div>

Hi Jay,

does the problem persist if you try with a Bro 1.o release? Also, ensure  
that the pcap library Bro picks does have large-file support itself.

> Hi, I want to run bro with 300GB pcap file but it cannot run

[snip]

> How can I do?

Cheers,  
Christian.

---

<div class="post-metadata">

**Author:** ![Antonatos\_Spiros](https://avatars.discourse-cdn.com/v4/letter/a/6a8cbe/32.png) [@Antonatos\_Spiros](https://community.zeek.org/u/Antonatos_Spiros)\
**Post date:** [March 6, 2006, 8:21pm UTC](https://community.zeek.org/t/cannot-read-large-pcap-file/935/3 "2006-03-06T20:21:56Z")

</div>

pcap library does not support large files (u have to manually add the  
O\_LARGEFILE in open()'s flags and recompile pcap). A trick done is to 'cat'  
the file and have your program (bro, tcpdump, whatever) read from stdin.  
Works fine in debian

Spiros Antonatos

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:37pm UTC](https://community.zeek.org/t/cannot-read-large-pcap-file/935/4 "2022-05-06T15:37:48Z")

</div>

Closed on May 6, 2022, 3:37pm UTC