Revision history  [back]

tcpdump writes the pcap file in blocks of a certain size. This means that during the capturing, the file ends in the middle of a packet. If you copy the file while tcpdump is still capturing, the last packet in the file will not be completely written yet, hence the error message in Wireshark.

If you stop tcpdump before copying the file, the remaining buffer will be written to disk and all packets will be complete.