Wireshark-dev: [Wireshark-dev] Fwd: wireshark file not showing all packets but showing only the
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: prashanth s <prbanglore@xxxxxxxxx>
Date: Sat, 20 Feb 2010 02:00:17 +0530
It shows in the pcap at the bottom: Packets: 3481   Displayed: 3481    Marked : 0
But actually only the first frame is displayed.





Hi all,
 
I had captured a trace two days ago, using tcpdump and using the -w option wrote that to a .pcap file. The pcap file was showing all the TCP segments clearly from SYN to FIN. Its size is 28 KB.
But suddenly now there is an error diplayed when I open the pcap:  "The capture file appears to have been cut short in the middle of a packet."
Also only one ethernet frame is shown instead of all the frames. No TCP is shown now. The size of the pcap file has not changed however. This is true for all other pcaps for TCP traffic I captured today. Some of them are well over 2 mb. But its only one frame is displayed when I open the pcap. They also display the same error message before the file is opened. Could any of you suggest the remedy for this, it would be of great help to me.
 
 
Regards,
Prashanth