Wireshark-users: [Wireshark-users] Corrupted cap file
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Robert Smith <wmk589@xxxxxxxxx>
Date: Thu, 24 Jan 2008 05:06:29 -0800 (PST)
Due to some communication problems tshark produced corrupted capture file.

When I try to open it in Wireshark I see in the Open Capture File dialog: "Error after reading 2008 packets". The size  of the file is 698854 bytes.

After clicking on OK button Wireshark displays the following error message: "The capture file appears to be damaged or corrupt. (pcap: File has 842151219-byte packet, bigger than maximum of 65535). Then Wireshark displays the correct portion of the file, 2008 packets.

My question is, whether there are tools which allows to repair corrupted capture file and extract from it as much information as possible?

Thanks

Be a better friend, newshound, and know-it-all with Yahoo! Mobile. Try it now.