This is our old Q&A Site. Please post any new questions and answers at

I recently upgraded to 2.2.0 on the Mac and noticed that I no longer get OpenBSD ENC Encapsulated captures automatically decapsulated and have not found a manual way to do so either. The ones I routinely use are taken on pfSense's IPsec interface. The data is there, but all I see in wireshark now is Protocol ENC. Frames show as [Protocols in frame: enc:data] In older versions they would appear as, for example, [Protocols in frame: enc:ip:udp:data] with the data portion decoded and displayed.

$ capinfos -E packetcapture.cap
File name:           packetcapture.cap
File encapsulation:  OpenBSD enc(4) encapsulating interface

Is there a way to tell latest Wireshark to decapsulate these captures again?

asked 05 Oct '16, 16:14

backsnarf's gravatar image

accept rate: 0%

Still an issue on 2.2.3. Anyone know how to trigger automatic decapsulation of the plaintext data in these captures?

(29 Dec '16, 09:39) backsnarf

Either a sample capture of a full bug report would be needed to help this along.

(29 Dec '16, 10:48) Jaap ♦

Created bug with a sample capture file.

(29 Dec '16, 12:52) labrat

The solution is to upgrade to Wireshark 2.2.4, which contains a fix for this bug.

permanent link

answered 31 Dec '16, 02:39

Jaap's gravatar image

Jaap ♦
accept rate: 14%

Thank you so very much. Confirmed working again in 2.2.4-RC.

(31 Dec '16, 13:41) backsnarf
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 05 Oct '16, 16:14

question was seen: 1,007 times

last updated: 31 Dec '16, 13:41

p​o​w​e​r​e​d by O​S​Q​A