Hi,
You can use editcap to remove the malformed packet:
editcap <infile> <outfile> <number of the packet you want to remove>
$ editcap temp.cap temp2.cap 10
Add_Selected: 10
Not inclusive ... 10
$ capinfos -c temp.cap temp2.cap
File name: temp.cap
Number of packets: 30
File name: temp2.cap
Number of packets: 29
Hope this helps
Joan
On Sun, 30 Aug 2009 11:46:22 +0200 samyc wrote:
>
>Hello,
>When reading a pcap with a malformed packet tshark stops to read the .pcap
>file.
>Is there a an option to tell tshark to conitnue .pcap analysis?
>BR
