>
> >Hi, thanks for the explanation. But what do you mean saying "snapshot"?
> :)
>
> Specifying a max length per-packet to be written to the capture file e.g
> cuting the packets off at that length.
>
OK, understood :) Thank you. So, I sum it up in case other people would get confused by the error message:
The "Malformed Packet" message is displayed when Wireshark tries to access packet area residing beyond the real packet end. It is not because the packet was cut due to some capturing settings but because the complete packet does not have the bytes Wireshark is triing to access. In case bytes are not available due to capture cut - different error message is displayed.
Maybe it would be a good idea to change the error output? "Malformed Packet" is too general and misleading sometimes. For example, not the packet could be malformed but the dissector could be buggy :)
Or maybe the detailed failure reason should be put on the help page: http://www.wireshark.org/docs/wsug_html_chunked/AppMessages.html
It would spare a lot of confusion.
