https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7381
Summary: The file appears to be damaged or corrupt.. (pcapng:
interface index 1 is not less than interface count 1.)
Product: Wireshark
Version: SVN
Platform: x86
OS/Version: Mac OS X 10.6
Status: NEW
Severity: Major
Priority: Low
Component: Wireshark
AssignedTo: bugzilla-admin@xxxxxxxxxxxxx
ReportedBy: jyoung@xxxxxxx
Created attachment 8627
--> https://bugs.wireshark.org/bugzilla/attachment.cgi?id=8627
small 12 packet pcapng file
Build Information:
wireshark 1.9.0-SVN-43401 (SVN Rev 43401 from /trunk)
Copyright 1998-2012 Gerald Combs <gerald@xxxxxxxxxxxxx> and contributors.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Compiled (64-bit) with GTK+ 2.24.5, with Cairo 1.8.6, with Pango 1.29.3, with
GLib 2.29.8, with libpcap, with libz 1.2.3, without POSIX capabilities, with
SMI
0.4.8, without c-ares, without ADNS, with Lua 5.1, without Python, with GnuTLS
2.12.7, with Gcrypt 1.4.6, with MIT Kerberos, with GeoIP, with PortAudio
V19-devel (built Sep 30 2011 11:17:29), with AirPcap.
Running on Mac OS 10.6.8 (Darwin 10.8.0), with locale .UTF-8, with libpcap
version 1.0.0, with libz 1.2.3, GnuTLS 2.12.7, Gcrypt 1.4.6, without AirPcap.
Built using gcc 4.2.1 (Apple Inc. build 5666) (dot 3).
--
mergecap generated pcapng file is unusable.
I have a series of pcapng files generated using dumpcap with the ringbuffer
duration option (e.g. $ dumpcap -i en0 -i en1 -f 'arp or (host 192.168.0.99 and
icmp)' -w ringtest.pcapng -b duration:5).
The individual ringtest*pcapng files superficially appear to be well-formed and
can be opened and processed by wireshark and the various wireshark cli tools
(tshark, capinfos, editcap, mergecap, etc).
But if several of the ringtest*pcapng file are combined together using the
mergecap tool (e.g. $ mergecap -w combined.pcapng ringtest_0000[12]*pcapng) the
resulting pcapng is unusable with the error message "(pcapng: interface index 1
is not less than interface count 1.)".
tshark returns the following error message:
> $ tshark -r combined.pcapng
>
> tshark: The file "combined.pcapng" appears to be damaged or corrupt.
> (pcapng: interface index 1 is not less than interface count 1.)
capinfos returns the following error message:
> capinfos combined.pcapng
> capinfos: An error occurred after reading 0 packets from "combined.pcapng": The file appears to be damaged or corrupt..
> (pcapng: interface index 1 is not less than interface count 1.)
editcap returns the following error message:
> $ editcap -c 1 combined.pcapng splittest.pcapng
> editcap: An error occurred while reading "combined.pcapng": The file appears to be damaged or corrupt..
> (pcapng: interface index 1 is not less than interface count 1.)
To replicate the problem do the following with the attached pcapng file:
> editcap -i 1 ringtest_00001_20120618221355.pcapng splittest.pcapng
> mergecap -w recombined.pcapng splittest*pcapng
> capinfos recombined.pcap
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.
