Wireshark-users: [Wireshark-users] Reading tshark output using wireshark
From: "Philipp Walther" <[email protected]>
Date: Mon, 30 Apr 2007 03:20:02 -0400
Hi all,

I'm trying to sniff data using tshark (I could not compile wireshark on
linux,
but that's okay (no gtk on server)) and then read it using the wireshark
GUI on
Windows.

This does not seem to work yet, as I get the error 
"The capture file appears to be damaged or corrupt.
(pcap: File has 1342289141-byte packet, bigger than maximum of 65565)"

[[email protected] ~]# tshark -w sniff.txt -s 65535 -c 1000 -l
Capturing on eth0
1000 
[[email protected] ~]# tshark -v
TShark 0.99.5

Version on windows: 0.99.5 (SVN Rev 20677)

I had similar issues when trying to read a tcpdump file..

Anybody had this issue as well?

Thanks in advance

Cheers
Phil