Wireshark · Wireshark-users: Re: [Wireshark-users] network monitor 3.4 traces cannot be read

[Graham Bloice <graham.bloice@xxxxxxxxxxxxx>]

On 22/07/2010 20:21, Guy Harris wrote:

On Jul 22, 2010, at 12:01 PM, Stefaan Pouseele wrote:

attached you'll find a sample capture taken with Microsoft Network Monitor
3.4.

Works fine for me, with an SVN build of version 33612, on an x86-64 machine, built on OS X 10.6 with GCC; it's a bunch of HTTP traffic.  I'm assuming it's not working for you, i.e. you can't read that capture.  (We need captures from NM 3.4 that Wireshark *can't* read; I just did a capture with NM 3.4, and the version of Wireshark that was able to read your file was also able to read that file, so it is *definitely* not the case that recent Wiresharks from the trunk cannot read *any* NM 3.4 traces.)

What SVN version are you using, and on what type of processor and OS are you trying to read it?  (Note that 1.4.0rc1 definitely will have problems reading some NetMon captures, as will 1.3.x builds; the fixes I checked in were done after 1.4.0rc1 was built.)

Here's my capture.  Captured on Win 7 x64 Pro with NM 3.4 (3.4.2350.0).  Tried to load in to Wireshark x64 1.5.0-SVN-33615 with the error I reported previously.  The capture has DNP3 traffic on port 2000 captured on a PPTP VPN.

-- 
Regards,

Graham Bloice

Attachment: test.cap
Description: Binary data