The capture file appears to be damaged or corrupt. (pcap: File has 65706-byte packet, bigger than the maximum of 65535) Hello, I am having an issue when trying to debug some voip calls. I capture the errors but the wireshark file is always corrupt with the error at the top of my post. I have tried using the wireshark GUI and also dumpcap using the following string
All files that i create are corrupt, even if I set dumpcap to create only a 5mb file this shows as corrupt. I have tried using Wireshark version 1.6.4 and 1.6.5. The operating system is Windows 2008 64 bit R2 on VMWare. UAC and Windows Firewall are turned off has anyone ever seen this issue? asked 09 Feb '12, 07:16 processflows... edited 09 Feb '12, 07:18 grahamb ♦ |
3 Answers:
Did you capture the packets on the same system as where you are trying to view them in Wireshark? If not, how did you transfer the file from the capturing system to the Wireshark PC? Most times I have seen this message, the files were transferred by FTP, but in ASCII mode instead of BINARY mode. This will mangle the file (as different systems use different line endings and FTP in ASCII mode tries to change byte sequences that look like line-endings). So if you did transfer the file with FTP, please enable BINARY mode before sending the file over. answered 09 Feb '12, 09:07 SYN-bit ♦♦ |
It seems like you might have a version of libpcap (winpcap) that has been modified. You should not see captured packets longer than 65535 bytes. Try reinstalling winpcap. Alternatively, if you have an intentionally modified version of winpcap (perhaps one that supports larger packets), you'll need to adjust the following:
and
answered 09 Feb '12, 08:54 multipleinte... |
Updating to the latest version 1.12 (at the moment) resolved the issue for me answered 11 Sep '14, 13:57 Tesla Perhaps Windows was doing TCP segmentation offloading, and delivered packets that actually were reassembled from multiple network packets and that were larger than 65535 bytes. 1.12 increased the maximum packet size to 262144 bytes, and thus didn't complain about those larger packets. (12 Sep '14, 13:22) Guy Harris ♦♦ |
Thanks for the replies, I will get them to uninstall Winpcap. We have uninstalled and reinstalled wireshark but I am wondering if that also fully uninstalled/reinstalled winpcap at the same time. So I will uninstall Winpcap first, then wireshark, do a reboot and then reinstall from a fresh download. all software is direct download from the website with no modifications.
I dont think its the FTP issue as the files on the machine itself also seem to be corrupt. I did consider unusual partitioning on the server but it seems to be standard NTFS.
Make sure your installer isn't getting corrupted during the download. It's unlikely, but you should probably do the verification anyway, given the nature of your problem. The 1.6.5 signature is available in the signatures file. The latest signatures file can always be found on the downloads page.