Change default save file type

asked 2025-08-22 05:17:58 +0000

mystere gravatar image

Hi,

when I merge 3 files each around 100 mb Wireshark gives "the capture file appears to be damaged or corrupt pcap bigger than maximum of 262144" error. While select 3rd file it asks me to save first 2. If I directly save it default file type I got error. But if I select "modidfed pcap file" can able to save without any error.

So how can I change default file type "modified pcap file"? Is it possible?

edit retag flag offensive close merge delete

Comments

What version of Wireshark are you using? I don't think what you're asking for would help necessarily, because if something is going wrong it is likely related to trying to perform a "fast save" that writes out a file in the current format, and the file is being read with old offsets. Changing the default file type would probably still have the same problem - you're avoiding the problem because you're changing the file type from one stsp to another, so the "fast reread" path is avoided.

johnthacker gravatar imagejohnthacker ( 2025-08-22 20:56:04 +0000 )edit

Version is 4.4.8. Tried older versions of Wireshark, different Windows profiles, changed ram nothing is working. Atm saving files as "modified pcap" avoid from error. Would be nice if "modified pcap" type can be default.

mystere gravatar imagemystere ( 2025-08-25 04:43:57 +0000 )edit
add a comment