Wireshark-users: [Wireshark-users] Dump file format?
From: Trevor Bosaw <bosawt@xxxxxxxxxxxxxxxx>
Date: Mon, 14 Apr 2008 21:26:59 -0700
Hey,

I have been examining data from a group that saves their packet data in a dump file. Wireshark recognizes these dump files, but they are too large, and it crashes before it can finish reading in the entire file. I have been able to split the files using the Unix command 'split', but since this command obviously cannot read the dump format, it splits the file in the middle of a packet.

Now, I don't really care about the loss of this packet, as it is only one among thousands, but when I try to load the second portion of the file that was split, wireshark doesn't recognize it (since it starts with the second part of a packet, and not a new one).

Does anyone know what the wireshark dump file format is, and if so, if it's possible that I can manually open the second and on portions of the dump file, delete the second part of the packet, and load the rest into wireshark?

I am not sure if this will appear appropriately on other computers, but here is an example of a packet from the dump file:

‘√≤°`P”Ceå 6åfl§ † \E~kí@6ìÙÍ>É@J‚P£ƒZ«AD§O¶P–Ã

This is exactly one packet.
Also, here is a selection of the very beginning of the second part of the file:

Ø˛©P˙ÏÕR”Ce 6 fl§ † \E˚øi@q«‹∂ú Ö"Ñ©ØP‰Ó‡ì8=œΩP˝ = R”Cl 6Ofl§ † \EA¯É@4£¡ƒ'xÀ«Ä5-Ï.ITR”Cû 6<† \fl§ E(w⁄@v¡†É@J‚ÙÍ> £âP·ñÑrXÛ(‘PˇˇX’R”CB 6<† \fl§ E(w€@v¡üÉ@J‚ÙÍ>£âP·ñÑrXÛ3ÄPıSX’R”CÊ 6<† \fl§ E(Û€@vèP°Í∆ F”©®PÙü6Å

Again, this is just gibberish to me, so I really don't know exactly what to delete from the second file.

Any help would be very much appreciated.

-Thanks