This is our old Q&A Site. Please post any new questions and answers at


I have a .cap file that is 4Mo leght.

When i try to open it with wishark, i have an error that says "pcap: File has 1869904672-byte packet, bigger than maximum of 65535).

Someone knows how to open my complete .cap file ?

Thank you.

asked 24 May '11, 09:59

parisien's gravatar image

accept rate: 0%

retagged 25 May '11, 21:47

helloworld's gravatar image


It's not the file size that's choking Wireshark, it's that a single packet is almost 2 billion bytes in size. Either you guys are running jumbo packets OR there's something wrong with the capture file. Did you capture it with wireshark, or with another tool?

You can also look into running editcap with the -s parameter and limited the packet lengths to roughly 1500. Of course...this could be a bug with packet reassembly. Which version of WireShark are you using?

permanent link

answered 24 May '11, 11:49

GeonJay's gravatar image

accept rate: 5%

This usually is a result of transferring the file through FTP and not selecting binary mode. This will mess up the CR/LF and/or LF in the file. Did you use FTP to retrieve the file? If so, could you try again, but now with binary mode?

permanent link

answered 24 May '11, 12:50

SYN-bit's gravatar image

SYN-bit ♦♦
accept rate: 20%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 24 May '11, 09:59

question was seen: 7,331 times

last updated: 25 May '11, 21:47

p​o​w​e​r​e​d by O​S​Q​A