Revision history  [back]

I'm on Ubuntu 19.10.

I have a pcap file x.pcap which i can evaluate using tshark -r x.pcap

I want to work with compressed pcap files.

I do lz4 x.pcap. Trying to evaluate with tshark -r x.pcap.lz4 fails with "tshark: The file "x.pcap.lz4" isn't a capture file in a format TShark understands."

tshark -v shows version "TShark (Wireshark) 3.0.5 (Git v3.0.5 packaged as 3.0.5-1)" and lists "with zlib 1.2.11"