Ask Your Question

the capture file appears to be damaged or corrupt

asked 2020-06-12 15:13:02 +0000

jasonwenst gravatar image

i use "tshark -n -i8 -V -x > output.pcap" to write data in the file, when i open the file by wireshare, appear the error, how can I solve the error,thanks.

My wireshark version is 3.2.4 and OS is windows 10

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2020-06-12 15:52:22 +0000

grahamb gravatar image

updated 2020-06-12 19:06:21 +0000

Guy Harris gravatar image

To write a pcap file use the -w option, e.g.

tshark -n -i8 -F pcap w output.pcap

Note the -V and -xoptions have been removed as they are used for text output, not pcap output and the -F pcap option has been added to change the output file type to pcap instead of the default pcapng. If you're happy with pcapng, then you can omit the -F pcap option.

Without the -w option, TShark writes a text file containing information from dissecting the packet (the command in the question will write out packet details, in a fashion similar to what Wireshark shows in the packet details pane). Wireshark can't read those files.

edit flag offensive delete link more


use 'tshark -n -i8 -V -x -w output.pcap' the file can opend by wireshark, but it looks like the filesize is limited, the output file should about 4MB , but it always stop writing data when the filesize is 800KB, so i try to use '>' to write the data.

jasonwenst gravatar imagejasonwenst ( 2020-06-13 01:46:57 +0000 )edit

How are you stopping the capture or is there a message displayed that it was ended?

Chuckc gravatar imageChuckc ( 2020-06-13 02:02:20 +0000 )edit

-a duration:60 i use this

jasonwenst gravatar imagejasonwenst ( 2020-06-13 02:30:01 +0000 )edit

tshark is making a call to dumpcap for capture.
Here is an example running for 10 seconds:

$ dumpcap.exe -i4 -a duration:10 -w output.pcap
Capturing on 'Ethernet'
File: output.pcap
Packets captured: 99
Packets received/dropped on interface 'Ethernet': 99/0 (pcap:0/dumpcap:0/flushed:0/ps_ifdrop:0) (100.0%)

If you run dumpcap.exe -i8 -a duration:60 -w output.pcap is the file size different?

Chuckc gravatar imageChuckc ( 2020-06-13 02:51:20 +0000 )edit

in real scenario i use the command tshark -n -i8 -V -x -a duration:3600 -w output.pcap and the filesize is 800KB my test command is tshark -n -i8 -V -x -a duration:600 -w output.pcap

and the filesize is 400KB, they are in a same server, maybe is the filesize limited, if use 60 second, the filesize is equals.

jasonwenst gravatar imagejasonwenst ( 2020-06-13 03:24:07 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2020-06-12 15:13:02 +0000

Seen: 2,527 times

Last updated: Jun 12 '20