 | 1 | initial version |
Without access to the offending pcapng file, I would speculate that an enhanced packet block contains an _Interface ID_ which does not correspond to an interface description block in this section. From the number given (47) it would appear there should be at least 48 interface descriptor blocks, which, under normal conditions, is unlikely.
To confirm this, you could try to use View|Reload as File Format/Capture to try to load the file that way and dig into the blocks. As for fixing this, I'm not sure what, if any, tool would be able to do this. Surely hacking it with a hex editor would work. First and foremost I would look at the tool that created this capture file to see why it produced a file like this.
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
