Wireshark-users: Re: [Wireshark-users] Running tshark on large pcap files
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Christopher Maynard <Christopher.Maynard@xxxxxxxxx>
Date: Wed, 12 Jun 2013 16:42:04 +0000 (UTC)
Evan Huus <eapache@...> writes:

> > And it also doesn't seem like I can split up the files with editcap.
> > Whenever I tried to do that with the large pcap files, I got empty output
> > files (24 bytes) instead. I'm not sure if it was due to the large file size.
> 
> That's odd. If you can reproduce consistently (and perhaps with a
> smaller capture) please file a bug.

This might be bug 2868: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2868

Did you try passing, "-F libpcap" to editcap?