Ask Your Question
0

unrecognized libpcap format error message

asked 2018-12-31 01:52:36 +0000

hikerguy gravatar image

Hello,

I'm running Wireshark within GNS3. When I create a topology in GNS3 and click on a link between, say, two routers and select "Start capture" then Start Wireshark, everything works fine. However, when I stop a capture and try to restart a new capture, I ALWAYS get the message "Unrecognized libpcap format or not libpcap data."

I have tried uninstalling winpcap, rebooting, reinstalling then rebooting again, but the problem persists. How can I fix this? The only work around it to completely stop Wireshark and restart it from within GNS3.

I'm on a Win10 PC running the latest version of Wireshark (v2.6.5).

Thanks,

Andy

edit retag flag offensive close merge delete

1 Answer

Sort by ยป oldest newest most voted
0

answered 2018-12-31 02:12:42 +0000

Guy Harris gravatar image

This message means that 1) Wireshark is reading a capture from a pipe, rather than capturing on a network adapter and 2) whatever is writing to the pipe didn't write it in one of the standard Wireshark capture file formats, namely pcap and pcapng.

"Whatever is writing to the pipe" is presumably GNS3. There is at least one GNS3 issue about this - issue #2235.

edit flag offensive delete link more

Comments

or rather in this case, 2) whatever is writing to the pipe isn't aware the reading is restarted and thus needs to write a PCAP global header first. This is one of the reasons the extcap interface was created.

Jaap gravatar imageJaap ( 2018-12-31 10:59:21 +0000 )edit

Hence this is an issue with GNS3, not Wireshark. (That's why I changed the messages issued in those cases to recommend that people report the problems to the people maintaining the program that's writing to the pipe.)

Guy Harris gravatar imageGuy Harris ( 2018-12-31 18:22:15 +0000 )edit

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools

1 follower

Stats

Asked: 2018-12-31 01:52:36 +0000

Seen: 3,582 times

Last updated: Dec 31 '18