This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Can’t reanimate a capture file.

0

I cannot open a file from a packet capture. Granted the file size is 1.9 GBs. When attempting to open the file I receive this message several minutes later... "This application has requested the Runtime to terminate it in an unusual way. Microsoft Visual C++ Runtime Library" Is this due to the size of the capture file? Please help, or can someone step me through it? Thanks in advance.

asked 22 Apr '11, 10:15

digirati's gravatar image

digirati
1111
accept rate: 0%


One Answer:

1

Yes, this is due to the size of the capture file, it is probably too big to be loaded into Wireshark. What you can do is use the command line tool editcap to cut it into smaller files, for example

editcap -c 100000 <yourbigfile> <outfile>

You'll get a couple of files with 100,000 frames each, which should work without problems. Editcap is installed along Wireshark into the program directory.

answered 22 Apr '11, 10:31

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

edited 22 Apr '11, 10:31

(22 Apr '11, 10:38) SYN-bit ♦♦