Wireshark · Ethereal-users: Re: [Ethereal-users] Open capture

[Guy Harris <gharris@xxxxxxxxx>]

FRANCIS PROVENCHER wrote:

> Im on a debian box with Ethereal 0.10.10 fresh install.
> On my command line a type Tethereal -a duration:600 (Four 5 minutes of
> Capture) -w sniffiles.cap
>
> When i open the capture files on my Windows 2000 with Ethereal 0.10.10,
> i have always an error..
>
> "The capture file appears to have been cut short in the middle of a
> packet."
>
> Or 
>
> "The capture file appears to be damaged or corrupt.
> (pcap: File has 4194314-byte packet, bigger than maximum of 65535)"

So are you copying the file from the Debian box to your Windows machine?

If so, how are you doing the copy?  Is it being copied by a program that 
copies raw file data, or might it be trying to transfer the file as an 
ASCII text file (in which case the transformation between the UN*X 
line-feed line ending and the Windows carriage-return/line-feed ending 
will cause the copy on the Windows machine to be damaged and unreadable)?