This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I cannot open a file from a packet capture. Granted the file size is 1.9 GBs. When attempting to open the file I receive this message several minutes later... "This application has requested the Runtime to terminate it in an unusual way. Microsoft Visual C++ Runtime Library" Is this due to the size of the capture file? Please help, or can someone step me through it? Thanks in advance.

asked 22 Apr '11, 10:15

digirati's gravatar image

digirati
1111
accept rate: 0%


Yes, this is due to the size of the capture file, it is probably too big to be loaded into Wireshark. What you can do is use the command line tool editcap to cut it into smaller files, for example

editcap -c 100000 <yourbigfile> <outfile>

You'll get a couple of files with 100,000 frames each, which should work without problems. Editcap is installed along Wireshark into the program directory.

permanent link

answered 22 Apr '11, 10:31

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

edited 22 Apr '11, 10:31

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×549
×91
×63
×23

question asked: 22 Apr '11, 10:15

question was seen: 3,193 times

last updated: 22 Apr '11, 10:38

p​o​w​e​r​e​d by O​S​Q​A