Ask Your Question
0

Unable to open PCAP file

asked 2024-03-08 05:52:38 +0000

It shows error that record contains data that wireshark doesn't support. PCAP Network type reserved field not zero (0x006d0000)

edit retag flag offensive close merge delete

1 Answer

Sort by » oldest newest most voted
0

answered 2024-03-08 13:24:52 +0000

André gravatar image

updated 2024-03-08 13:27:58 +0000

Either the file you try to open is corrupt or it does not contain a proper pcap header.

On Linux the command file is available that can help identifying the true type (by contents).

edit flag offensive delete link more

Comments

On most UN*Xes the command file is available that can help identifying the true type (by contents).

On most UN*Xes there's also a command od, which, the "o" standing for "octal" notwithstanding, can be used to get a hex dump of the beginning of the file. Running the command od -t x4 -N 24 {file name}, where {file name} is the pathname of the file, should provide a hex dump of the file's header. If you can do that from the command line, and show us the output, that would help us figure out what's wrong with that file.

Guy Harris gravatar imageGuy Harris ( 2024-03-08 20:11:50 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

Stats

Asked: 2024-03-08 05:52:38 +0000

Seen: 611 times

Last updated: Mar 08