Unable to open PCAP file
It shows error that record contains data that wireshark doesn't support. PCAP Network type reserved field not zero (0x006d0000)
1 Answer
- Sort by
oldest newest most voted
0
Either the file you try to open is corrupt or it does not contain a proper pcap header.
On Linux the command file is available that can help identifying the true type (by contents).
Comments
On most UN*Xes the command file is available that can help identifying the true type (by contents).
On most UN*Xes there's also a command od, which, the "o" standing for "octal" notwithstanding, can be used to get a hex dump of the beginning of the file. Running the command od -t x4 -N 24 {file name}, where {file name} is the pathname of the file, should provide a hex dump of the file's header. If you can do that from the command line, and show us the output, that would help us figure out what's wrong with that file.
Your Answer
Please start posting anonymously - your entry will be published after you log in or create a new account.
This space is reserved only for answers. If you would like to engage in a discussion, please instead post a comment under the question or an answer that you would like to discuss.
Comments