Hi All, I'm getting this error when trying to open pcapng file in wireshark. The file ** appears to be damaged or corrupt. (pcapng: interface index 47 is not less than section interface count 1).
Any idea what can be the problem, and how can I fix it?
Without access to the offending pcapng file, I would speculate that an enhanced packet block contains an _Interface ID_ which does not correspond to an interface description block in this section. From the number given (47) it would appear there should be at least 48 interface descriptor blocks, which, under normal conditions, is unlikely.
To confirm this, you could try to use View|Reload as File Format/Capture to try to load the file that way and dig into the blocks. As for fixing this, I'm not sure what, if any, tool would be able to do this. Surely hacking it with a hex editor would work. First and foremost I would look at the tool that created this capture file to see why it produced a file like this.
Asked: 2022-09-13 21:07:31 +0000
Seen: 745 times
Last updated: Sep 14 '22
