Wireshark-users: Re: [Wireshark-users] captured file can not be understood by Tshark

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Tue, 02 Jan 2007 10:43:57 -0800

joyce wrote:

My system will generate monitor log file in both ASCII(Monitor.log.1.zip) and pcap version(Monitor.pcap.1.00009) as attached. Because the ASCII version log does suitable for extracting information, I use tshark to decode the pcap version file and so far works fine. However my system met a reboot a few days ago, and today the monitor restart again and write to the log file from the point it stopped last time. later I got the error when decoding this file. I suspect it’s caused by the system reboot during the process of log writing, however I don’t know what is missing in the log file that tshark can not recognize the format. Wireshark give me the same error.

So does tcpdump:

	$ tcpdump -r /tmp/Monitor.pcap.1.00009
	tcpdump: bad dump file format

What's missing is a valid libpcap-format file header. If your monitor software restarts, and starts writing to a log file, the new log file has to begin with a libpcap-format file header.