Hello im trying to capture traffic and after saving and uploading pcap file i get this alert on tcp stream:
thanks in advance for any help. 2x2i asked 25 Aug '14, 11:33 2x2i edited 26 Aug '14, 08:06 JeffMorriss ♦ |
One Answer:
This usually indicates that some frames (packets) in a TCP connection weren't captured (and you're doing "follow TCP stream" to view what went back and forth on the socket). Rather than stopping when some bytes are missing, Wireshark continues to show the TCP stream but shows you where the data is incomplete. To fix the problem you need to ensure you capture all the packets. Unfortunately this can be quite difficult to achieve in practice. answered 26 Aug '14, 08:05 JeffMorriss ♦ See the users related question as to why there may be missing bytes\packets: https://ask.wireshark.org/questions/35714/seeing-packet-size-limited-during-capture-with-ngenius-performance-manager-capture (26 Aug '14, 08:52) grahamb ♦ |
Did you transfer as binary? ftp transfer as ASCII will mangle the file.