Wireshark · Wireshark-users: Re: [Wireshark-users] can't read file

[Guy Harris <guy@xxxxxxxxxxxx>]

Jeff Morriss wrote:

> I beg to differ with the last statement.  I frequently receive "damaged" 
> files (it never ceases to amaze me) and I can frequently (but not 
> always) repair them:
>
> - open the file in my favorite 8-bit-clean editor[1]
> - global-search-and-replace "^M$" (the Ctrl-M must be entered "Ctrl-V 
> Ctrl-M") with nothing (empty string)
> - save and quit
>
> 9+ times out of 10 it works.

9+ != 10; yes, if *all* occurrences of 0x15 0x12 in the file are the 
result of a 0x12 in a capture file on a UN*X system being turned to 0x15 
0x12 as a result of transferring the file in ASCII mode to a Windows 
system - i.e., if, for example, the capture file has no HTTP or FTP or 
Telnet sessions with CR/LF in the data being transferred - then 
replacing all occurrences of 0x15 0x12 with 0x12 will undo the damage, 
but that can't be guaranteed.