Wireshark-dev: Re: [Wireshark-dev] could not open pcap stream
From: Jeff Morriss <[email protected]>
Date: Wed, 16 Jan 2008 10:07:38 -0500

prashanth joshi wrote:
First I do "follow tcp stream" and save the file. And then I am running the decoder on that file. But I am getting the error message as, "Error could not open pcap stream [Bad dump file format]. "
What may be the error in the above?
The file you saved from "follow tcp stream" is the contents of the TCP 
stream, not the packets that were used to create said stream.  If it was 
a TCP stream used by a web server, for example, you'd be better off 
viewing it with some kind of ASCII viewer (like vi or Notepad).