Hi, i tried to open a pcap-file with an unsuccessful SIP-registration, but i get the following error message: The file "hpbx_reg.pcap" is a capture for a network type that Wireshark doesn't support. (pcap: network type 538976257 unknown or unsupported) My Wireshark version is Version 1.10.6 (v1.10.6 from master-1.10) Regards Martin H. asked 11 Aug '15, 02:51  MaHa86 |
One Answer:
538976257 decimal is 20202001 hex, which has 3 blanks and a control-A, so this definitely looks as if the file was somehow damaged. What program produced the file, and what programs, if any, were used to transfer the file from the machine that produced it to the machine on which you read it? As Anders said, it might, for example, have been FTPed between a Windows machine and a UN*X machine in ASCII mode; that will probably damage any non-plain-text file, although whether it will produce that particular form of damage is another matter (it would convert hex 0A to hex 0D 0A when transferring from UN*X to Windows, transfer hex 0D 0A to hex 0A when transferring Windows to UN*X, and might do other things as well). answered 11 Aug '15, 15:22  Guy Harris ♦♦ |
The file may be broken, it wasn't ftp:d with ASCII rather than BIN by any chance?