See
http://www.wireshark.org/docs/wsug_html_chunked/ChAdvFollowTCPSection.html
Means that "Follow TCP Stream" keeps only the application layer data
(i.e. TCP, IP, Ethernet ... data is removed).
So you can NOT :
- save as in a .pcap format.
- reload the file into wireshark
I think you must do :
- conversation filter
- save as and select the option "Displayed" inside "Packet range"
frame.
Olivier
ram singh a écrit :
Hi all,
i have been using Wireshark for network analysis.But i can't
view the saved files(saved using Follow TCP Stream) in Wireshark
window.The error message reads as below:
"flow5.pcap" isn't a capture file in a format Wireshark understands.
Can anybody help me to save the files in proper format and also to
view that file.
------------------------------------------------------------------------
___________________________________________________________________________
Sent via: Wireshark-users mailing list <wireshark-users@xxxxxxxxxxxxx>
Archives: http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
mailto:wireshark-users-request@xxxxxxxxxxxxx?subject=unsubscribe
--
Wireshark Generic Dissector http://wsgd.free.fr
