Can’t reanimate a capture file.

Question

I cannot open a file from a packet capture. Granted the file size is 1.9 GBs. When attempting to open the file I receive this message several minutes later... "This application has requested the Runtime to terminate it in an unusual way. Microsoft Visual C++ Runtime Library" Is this due to the size of the capture file? Please help, or can someone step me through it? Thanks in advance.

Answer 1

Yes, this is due to the size of the capture file, it is probably too big to be loaded into Wireshark. What you can do is use the command line tool editcap to cut it into smaller files, for example

editcap -c 100000 <yourbigfile> <outfile>

You'll get a couple of files with 100,000 frames each, which should work without problems. Editcap is installed along Wireshark into the program directory.