Wireshark-dev: Re: [Wireshark-dev] could not open pcap stream
From: prashanth joshi <[email protected]>
Date: Wed, 16 Jan 2008 23:32:54 -0800 (PST)
Hi Jeff,
Thanks. As you said,  earlier, I was trying to run the decoder on the file saved from the follow tcp stream.  Now i'm able to  run the decoder.
Regards,
Prashanth

Jeff Morriss <[email protected]> wrote:


prashanth joshi wrote:
> First I do "follow tcp stream" and save the file. And then I am running
> the decoder on that file. But I am getting the error message as, "Error
> could not open pcap stream [Bad dump file format]. "
> What may be the error in the above?
> Regards,
> Prashanth

The file you saved from "follow tcp stream" is the contents of the TCP
stream, not the packets that were used to create said stream. If it was
a TCP stream used by a web server, for example, you'd be better off
viewing it with some kind of ASCII viewer (like vi or Notepad).
_______________________________________________
Wireshark-dev mailing list
[email protected]
http://www.wireshark.org/mailman/listinfo/wireshark-dev


Looking for last minute shopping deals? Find them fast with Yahoo! Search.