Wireshark · Ethereal-dev: Re: AW: [Ethereal-dev] Problems starting capturing

[Ulf Lamping <ulf.lamping@xxxxxx>]

Grossert, Alexander wrote:
> Addition:
>  
> Hello.
>  
> I investigated where the error occurs and it is obviously while trying 
> to create the dumpcap childprocess. I added some output to get the 
> exact command line called by ethereal and got this:
>  
> dumpcap -i \Device\NPF_{06B77D3B-3C97-45FA-8AF9-C81A4EBAF823} -Z -B 1
>  
> When calling this on the command line I only received some rubbish:
>  
> F  4C:\DOCUME~1\nb223890\LOCALS~1\Temp\etherXXXX0UP95S  P  ♥1  D  ♥0
>  
> When I removed the "hidden feature" -Z from the command it started 
> capturing:
>  
> File: C:\DOCUME~1\nb223890\LOCALS~1\Temp\etherXXXX0UP95S
>  
>  
> When I tell ethereal to capture to a specific file the result is the same.
>  
> Anyone an idea what could be wrong with dumpcap now?
The "rubbish" is some information in binary, that's intended and ok.

If you remove the -Z flag, dumpcap will use "human readable" format 
which Ethereal don't understand, so this will start capturing, but 
Ethereal won't work with it well.

Regards, ULFL