I received a capture from a client for analyze. Unfortunately if i can open the individual splitted files in Wireshark (tried with 1.10.6 x64 & x32), I cannot merge the files. I tried to do it from Wireshark itself and using mergecap but each time I receive the same error :
Of course I have space left on the disk and the directories are writable. I have no idea on what the problem is. I did exactly the same for another analysis received also yesterday from the same client that I could merge successfully.
Thanks if someone can help.
asked 21 Mar ‘14, 00:47
Can you check if there are more than one interface captured in the files? Mergecap does not work with those kind of files, it can only merge files captured on a single interface at this time. It is a known bug.
Easiest way to check is to open the Summary in the Statistics menu.
answered 21 Mar '14, 05:02