Wireshark-users: Re: [Wireshark-users] opening a tcpdump file in wireshark
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Sake Blok <sake@xxxxxxxxxx>
Date: Thu, 30 Apr 2009 08:49:48 +0200
On Wed, Apr 29, 2009 at 11:29:38PM -0700, Guy Harris wrote:

> Wireshark's native file format is libpcap format, which is also the  
> native file format of tcpdump, so one shouldn't need help to open a  
> tcpdump file in Wireshark; it should Just Work.  If it doesn't work,  
> that's a bug; please report it as such, to http://bugs.wireshark.org/.

Or the file was not created by giving tcpdump the -w option, but merely
by using something like "tcpdump .... > file.cap", in which case you
just have the ascii output of tcpdump in your file (can you open it in a
text editor?). If that's the case, there is no way of opening the file
in wireshark and you should do the tracing again, this time using
something like "tcpdump -s0 -w file.cap ...".

Cheers,
    Sake