Wireshark-users: Re: [Wireshark-users] Wireshark file format

From: wsgd <wsgd@xxxxxxx>
Date: Thu, 05 Mar 2009 20:03:46 +0100

See http://www.wireshark.org/docs/wsug_html_chunked/ChAdvFollowTCPSection.html

Means that "Follow TCP Stream" keeps only the application layer data (i.e. TCP, IP, Ethernet ... data is removed).

So you can NOT :
- save as in a .pcap format.
- reload the file into wireshark

I think you must do :
- conversation filter

- save as and select the option "Displayed" inside "Packet range" frame.

Olivier


ram singh a écrit :

Hi all,

i have been using Wireshark for network analysis.But i can't view the saved files(saved using Follow TCP Stream) in Wireshark window.The error message reads as below:

"flow5.pcap" isn't a capture file in a format Wireshark understands.

Can anybody help me to save the files in proper format and also to view that file.

------------------------------------------------------------------------

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe

--
Wireshark Generic Dissector http://wsgd.free.fr