Wireshark · Ethereal-users: Re: Re: [Ethereal-users] Can't save 'Selected Packets' to 'EtherPeek/AiroPeek trace (V9 file format)

[Ray Wang <raywang66@xxxxxxxxx>]

The original file was captured and saved by AiroPeek 2.0.2.  The
problem is that it's too big, 550MB, and AiroPeek is not able to open
the big files if you don't have a contiguous physical memory as big as
your file size.  Although my laptop has 1GB RAM, AiroPeek still can't
handle it.

Ethereal works perfectly to open such a big file, and all packets
(979,371) seem to have been decoded properly.  My point is Ethereal
has dealt with the AiroPeek format, and per-packet headers, etc.
correctly, why can't Ethereal save individual packets instead of
whole?

Thanks a lot for your help,

Ray

On Wed, 23 Jun 2004 12:40:55 -0700 (PDT), Guy Harris <gharris@xxxxxxxxx> wrote:
> 
> Ray Wang said:
> > When I tried to save selected packets or a range of packets, I got the
> > error msg:
> >
> > Ethereal does not support writing capture files in that format.
> >
> > But I was able to save "All packets" to the V9 file format, I verified
> > the saved file using AiroPeek 2.0.2.
> 
> Was the file you read a file in that format?
> 
> If you save all packets in a capture, Ethereal just copies the raw bytes
> of the capture file.
> 
> If you save selected packets, Ethereal has to know how to write a file
> header, and per-packet headers, for each of the packets it's saving.
> 
> Therefore, there are files that Ethereal can save all of in that file's
> format but that it can't save some of in that format.
> 
>