Wireshark-users: Re: [Wireshark-users] captured file can not be understood by Tshark

From: "joyce" <joyce.xie@xxxxxxxxxxxxxxxxxx>
Date: Wed, 3 Jan 2007 15:25:43 +0800

Hi Guy,
Thanks for your reply. What the "libpcap-format file header" looks like?

Regards
Joyce

-----Original Message-----
From: wireshark-users-bounces@xxxxxxxxxxxxx
[mailto:wireshark-users-bounces@xxxxxxxxxxxxx] On Behalf Of Guy Harris
Sent: Wednesday, January 03, 2007 2:44 AM
To: Community support list for Wireshark
Subject: Re: [Wireshark-users] captured file can not be understood by Tshark

joyce wrote:

> My system will generate monitor log file in both 
> ASCII(Monitor.log.1.zip) and pcap version(Monitor.pcap.1.00009) as 
> attached. Because the ASCII version log does suitable for extracting 
> information, I use tshark to decode the pcap version file and so far 
> works fine. However my system met a reboot a few days ago, and today the 
> monitor restart again and write to the log file from the point it 
> stopped last time. later I got the error when decoding this file. I 
> suspect it's caused by the system reboot during the process of log 
> writing, however I don't know what is missing in the log file that 
> tshark can not recognize the format. Wireshark give me the same error.

So does tcpdump:

	$ tcpdump -r /tmp/Monitor.pcap.1.00009
	tcpdump: bad dump file format

What's missing is a valid libpcap-format file header.  If your monitor 
software restarts, and starts writing to a log file, the new log file 
has to begin with a libpcap-format file header.
_______________________________________________
Wireshark-users mailing list
Wireshark-users@xxxxxxxxxxxxx
http://www.wireshark.org/mailman/listinfo/wireshark-users