Hello. I have a .cap file that is 4Mo leght. When i try to open it with wishark, i have an error that says "pcap: File has 1869904672-byte packet, bigger than maximum of 65535). Someone knows how to open my complete .cap file ? Thank you. asked 24 May '11, 09:59  parisien retagged 25 May '11, 21:47  helloworld |
2 Answers:
It's not the file size that's choking Wireshark, it's that a single packet is almost 2 billion bytes in size. Either you guys are running jumbo packets OR there's something wrong with the capture file. Did you capture it with wireshark, or with another tool? You can also look into running editcap with the -s parameter and limited the packet lengths to roughly 1500. Of course...this could be a bug with packet reassembly. Which version of WireShark are you using? answered 24 May '11, 11:49  GeonJay |
This usually is a result of transferring the file through FTP and not selecting binary mode. This will mess up the CR/LF and/or LF in the file. Did you use FTP to retrieve the file? If so, could you try again, but now with binary mode? answered 24 May '11, 12:50  SYN-bit ♦♦ |
