logged file size and actual file size differ / incomplete files

[joe1981al]

I just discovered wfilter and using it to try and rebuild a file from an MSN file transfer that I have a packet log of. I playback the log in burst mode with colosoft packet player and get an incomplete file, play it in real time mode and get an incomplete file.



I am getting a 514Kb avi file from WFilter but it reports a 48MB file in the reports. Looking at wireshark at the log, looks like the transfer started in tcp but changed over to udp, not sure if thats correct but thats what I'm seeing, looks like at the point it changes WFilter quits building the file...



Any solutions?

[admin]

There is a "Max Attachment Size" option in "System Settings"->"Manage Logs" of WFilter, with a default value of "20M". If the file size exceeds this limit, it will not be recorded. You can enlarge this option to make a try.



Actually, we don't encourage you to record large files, because it will cost too much diskspace.

[admin]

And what is the actual file size?

[joe1981al]

Actual file size is 48MB, I did change the setting to record larger files. It gives me the option to click on the file name in the console, and when I download the file it only downloads 514Kb from the console. I browsed to the log folder and found the file there, and it is only 514Kb.



From looking at a wireshark capture of this it looks like WFilter recorded the file size from the invite in MSN messenger, but is only following the initial TCP data before for some reason the msn switched the transfer over to UDP.

[sarahwilliams25]

joe1981al wrote: Actual file size is 48MB, I did change the setting to record larger files. It gives me the option to click on the file name in the console, and when I download the file it only downloads 514Kb from the console. I browsed to the log folder and found the file there, and it is only 514Kb.



From looking at a wireshark capture of this it looks like WFilter recorded the file size from the invite in MSN messenger, but is only following the initial TCP data before for some reason the msn switched the transfer over to UDP.

I have a similar issue. Did you find any solution?

[imfirewall]

sarahwilliams25 wrote: [quote=joe1981al]Actual file size is 48MB, I did change the setting to record larger files. It gives me the option to click on the file name in the console, and when I download the file it only downloads 514Kb from the console. I browsed to the log folder and found the file there, and it is only 514Kb.



From looking at a wireshark capture of this it looks like WFilter recorded the file size from the invite in MSN messenger, but is only following the initial TCP data before for some reason the msn switched the transfer over to UDP.

I have a similar issue. Did you find any solution?




Please leave us more information for us to reproduce this issue.