Ask Your Question

damaged pcapng file - interface index problem

asked 2022-09-13 21:07:31 +0000

mic11111 gravatar image

Hi All, I'm getting this error when trying to open pcapng file in wireshark. The file ** appears to be damaged or corrupt. (pcapng: interface index 47 is not less than section interface count 1).

Any idea what can be the problem, and how can I fix it?

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted

answered 2022-09-14 08:39:05 +0000

Jaap gravatar image

Without access to the offending pcapng file, I would speculate that an enhanced packet block contains an _Interface ID_ which does not correspond to an interface description block in this section. From the number given (47) it would appear there should be at least 48 interface descriptor blocks, which, under normal conditions, is unlikely.

To confirm this, you could try to use View|Reload as File Format/Capture to try to load the file that way and dig into the blocks. As for fixing this, I'm not sure what, if any, tool would be able to do this. Surely hacking it with a hex editor would work. First and foremost I would look at the tool that created this capture file to see why it produced a file like this.

edit flag offensive delete link more


Thanks a lot, it was very helpfull!

mic11111 gravatar imagemic11111 ( 2022-09-20 10:32:23 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower


Asked: 2022-09-13 21:07:31 +0000

Seen: 624 times

Last updated: Sep 14 '22