Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] Wireshark file format

From: wsgd <wsgd@xxxxxxx>
Date: Thu, 05 Mar 2009 20:03:46 +0100
See http://www.wireshark.org/docs/wsug_html_chunked/ChAdvFollowTCPSection.html

Means that "Follow TCP Stream" keeps only the application layer data (i.e. TCP, IP, Ethernet ... data is removed).

So you can NOT :
- save as in a .pcap format.
- reload the file into wireshark

I think you must do :
- conversation filter
- save as and select the option "Displayed" inside "Packet range" frame.


Olivier


ram singh a �crit :
Hi all,
i have been using Wireshark for network analysis.But i can't view the saved files(saved using Follow TCP Stream) in Wireshark window.The error message reads as below:
"flow5.pcap" isn't a capture file in a format Wireshark understands.
Can anybody help me to save the files in proper format and also to view that file.
------------------------------------------------------------------------

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe


--
Wireshark Generic Dissector http://wsgd.free.fr