ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-users: Re: [Wireshark-users] can't read file

From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
Date: Thu, 29 May 2008 09:53:24 -0400


Guy Harris wrote:
If it doesn't print anything about it being compressed, copy the file from the Windows machine to the HP-UX machine, and compare it with "/ tmp/sanG.trace" with the "cmp" command; if they're not equal, something got damaged when you copied it. (How did you copy it from the HP-UX machine to the Windows machine? If you used FTP, and you didn't FTP it in binary mode, it *definitely* got damaged, and there's no way to undo the damage.)

I beg to differ with the last statement. I frequently receive "damaged" files (it never ceases to amaze me) and I can frequently (but not always) repair them:

- open the file in my favorite 8-bit-clean editor[1]
- global-search-and-replace "^M$" (the Ctrl-M must be entered "Ctrl-V Ctrl-M") with nothing (empty string)
- save and quit

9+ times out of 10 it works. I've occasionally gotten Solaris' 'dos2unix' to repair the damage for me but it's much less reliable.

Of course I usually do this as a time-saving measure to avoid having to ask the person who sent the file to me (who may be many time zones away and quite possibly gone for the day already) to resend it.


[1] http://invisible-island.net/vile/