Wireshark-users: Re: [Wireshark-users] Reading tshark output using wireshark
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Sake Blok <sake@xxxxxxxxxx>
Date: Mon, 30 Apr 2007 09:47:24 +0200
On Mon, Apr 30, 2007 at 03:20:02AM -0400, Philipp Walther wrote:
> 
> I'm trying to sniff data using tshark (I could not compile wireshark on
> linux,
> but that's okay (no gtk on server)) and then read it using the wireshark
> GUI on
> Windows.
> 
> This does not seem to work yet, as I get the error 
> "The capture file appears to be damaged or corrupt.
> (pcap: File has 1342289141-byte packet, bigger than maximum of 65565)"

Did you by any chance use FTP to transfer the data? Since you used
the extension ".txt" instead of something like ".pcap", most FTP
clients will automatically treat it like ASCII and convert the
bare LF's in the file to "CR/LF".

Hope this helps,
Cheers,


Sake