This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

pcap: File has more bytes than defined

0
1

Hi

Wireshark Version: 1.12.4, RHEL 6.0

I have PCAP file with only one Frame of 683922 bytes, is there any size constraint to be lessthan or equal to 262144

Request your help

Please find the below screenshot for the error message alt text

Thanks Dinesh

asked 02 Sep '15, 01:17

Dinesh%20Babu%20Sadu's gravatar image

Dinesh Babu ...
16131517
accept rate: 0%

edited 02 Sep '15, 02:25


One Answer:

0

As the error message says, your file is corrupt. One way this happens is if you transfer the file from one system to another using FTP. Most FTP clients default to ASCII mode, but Wireshark trace files need to be transferred in Binary mode, not ASCII mode. If that's what happened here, and you still have the original file, then just repeat the transfer but this time put your FTP client in binary mode. For a command-line FTP client, the command "Type I" will do it.

answered 02 Sep '15, 10:24

Jim%20Aragon's gravatar image

Jim Aragon
7.2k733118
accept rate: 24%