Wireshark · Ethereal-users: Re: [Ethereal-users] Viewing trace file

[Guy Harris <guy@xxxxxxxxxx>]

> How can I view a trace file generated by tethereal ?
> 
> After running:
> 
> tethereal -n -ta -V -w /tmp/log.sniff

Note that "-n", "-ta", and "-V" are all irrelevant in that example;
Tethereal will write a raw binary capture, with no human-readable
interpretation - hence:

	no reporting of IP addresses as names or dotted quads, so "-n"
	is irrelevant;

	no printing of time stamps in human-readable form, so "-ta" is
	irrelevant;

	no printing of the protocol tree or a summary, so "-V" is
	irrelevant.

If you want a human-readable interpretation, you will, as Gilbert noted,
need to run Tethereal with the "-r" flag, *and* give any of the "-n",
"-ta", "-V", etc.  flags you want - or will need to feed that file to
some other program that reads libpcap-format capture files, such as
Ethereal or tcpdump.