Wireshark · Wireshark-users: Re: [Wireshark-users] Tshark - Value to large for defined data type

[Jaap Keuter <jaap.keuter@xxxxxxxxx>]

Hi,

Either script feeding the files to tshark and aggregate the results, or go with CACE Pilot for instance. 

Thanks,

Jaap

Send from my iPhone

On 17 jun 2010, at 10:20, mark-wade@xxxxxxxxxxx wrote:

Hello,

 

I am trying to use Tshark to read about 19,000 15MB files to get some network statistics.  My plan (since Tshark can't read files out of a directory) is to use mergecap to break the large number of files into larger files.  Basically I merged 1000, 15MB into one large file and had about 20 of these.  I know that Mergecap cant handle large files without a workaround, which I have.  Problem is now that I have these 19 files that range from 3GB to 15GB and now when I run # tshark -r pcapfile -q -z io, phs  I get the error, The file pcapfile could not be opened: Value to large for defined data type.

 

Anythoughts?

 

Thanks, 

___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
            mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe