File type is neither a supported pcap nor pcapng format

asked 2024-06-27 08:14:33 +0000

Harsh
1 ●1 ●1

updated 2024-06-27 08:41:50 +0000

grahamb

flag of United Kingdom of Great Britain and Northern Ireland

23835 ●4 ●976 ●227 https://www.wireshark.org

Hello Experts,

I am hoping for some help here regarding the error I get when I try to pipe tcpdump output to Wireshark on my Mac. I am running the following command getting this error.

ssh <username>@sw "tcpdump -s 0 -Un -w - -i et1" -batch | wireshark -k -i -

 (wireshark:35822) 01:03:45.418531 [GUI WARNING] -- Populating font family aliases took 147 ms. Replace uses of missing font family ".AppleSystemUIFont" with one that exists to avoid this cost.
 (wireshark:35822) 01:03:46.303276 [Capture MESSAGE] -- Capture Start ...
 (wireshark:35822) 01:03:46.850295 [Capture MESSAGE] -- Error message from child: "File type is neither a supported pcap nor pcapng format. (magic = 0x74203e0a)", "Please report this to the developers of the program writing to the pipe."
 (wireshark:35822) 01:03:50.123431 [Capture MESSAGE] -- Capture stopped.
 (wireshark:35822) 01:03:50.123547 [Capture WARNING] ui/capture.c:722 -- capture_input_closed():

I am running the latest version of Wireshark 4.2.5

Thank for your help

edit retag flag offensive close merge delete

Comments

Not sure what that "-batch" parameter is for/doing?

Jaap ( 2024-06-27 10:50:06 +0000 )edit

0x74203e0a = t > cr
Looks like extra characters.

root@ubuntu1:~# tcpdump -s 0 -Un -w - -i eth0 | hexdump
tcpdump: 0000000 c3d4 a1b2 0002 0004 0000 0000 0000 0000
listening on eth0, link-type EN10MB (Ethernet), capture size 262144 bytes
0000010 0000 0004 0001 0000 4c88 667d 56fc 0003
0000020 00a6 0000 00a6 0000 de74 972b 6e2c 0c00

tcpdump suppress console output in script & write to file

root@ubuntu1:~# tcpdump -s 0 -Un -w - -i eth0 2> /dev/null | hexdump
0000000 c3d4 a1b2 0002 0004 0000 0000 0000 0000
0000010 0000 0004 0001 0000 4d8e 667d 48a4 0008
0000020 00a6 0000 00a6 0000 de74 972b 6e2c 0c00

Pipe the ssh output to hexdump (or similar hex output program) and look for the magic numbers:
Magic numbers for supported capture files for Wireshark

Chuckc ( 2024-06-27 11:35:58 +0000 )edit

Do you mean to run ssh with -o BatchMode=yes or similar? I am not aware of a version that takes a flag -batch.

johnthacker ( 2024-06-27 15:41:06 +0000 )edit

For testing purposes you might want to limit tcpdump output to just one packet with the -c 1 option and direct the ssh output to the hexdump utility on the macOS system itself:

ssh <username>@sw "tcpdump -s 0 -Un -w - -i et1 -c 1" -batch | LC_ALL=C hexdump -C

Jim Young ( 2024-06-27 19:27:58 +0000 )edit

add a comment

% ssh ntppi.local. sudo tcpdump -i wlan0 -s 0 -U -w - -c 1 | tshark -i - Capturing on 'Standard input' tcpdump: listening on wlan0, link-type EN10MB (Ethernet), capture size 262144 bytes 1 packet captured 3 packets received by filter 0 packets dropped by kernel 1 0.000000 fe80::123:b28b:5ec9:ec65 → fe80::8be:fe4a:b13d:3dd1 SSH 270 0xedb6 Good 0xedb6 8bd2bb92edad14befdec64f73603ab91 0 22 60544 100426379 Server: Encrypted packet (len=184) 1 packet captured

% ssh ntppi.local. sudo tcpdump -i wlan0 -s 0 -U -w - -c 1 | Wireshark -k -i - tcpdump: listening on wlan0, link-type EN10MB (Ethernet), capture size 262144 bytes ** (wireshark:86816) 14:41:01.187675 [MATE MESSAGE] -- initialize_mate: entering 1 packet captured 3 packets received by filter 0 packets dropped by kernel ** (wireshark:86816) 14:41:01.234288 [Capture MESSAGE] -- Capture Start ... ** (wireshark:86816) 14:41:01.336244 [Capture MESSAGE] -- Capture started ** (wireshark:86816) 14:41:01.336276 [Capture MESSAGE] -- File: "/var/folders/wk/rjxg8gjs2zl8j_0xgwnn1y9r0000gn/T/wireshark_Standard inputYHRVP2.pcapng" ** (wireshark:86816) 14:41:01.402738 [Capture MESSAGE] -- Capture stopped.

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

File type is neither a supported pcap nor pcapng format

Comments

1 Answer

Your Answer

Question Tools

Stats

Related questions

File type is neither a supported pcap nor pcapng format edit

Comments

1 Answer

Your Answer

Question Tools

Stats

Related questions

File type is neither a supported pcap nor pcapng format