Wireshark · Wireshark-users: Re: [Wireshark-users] tshark stops

[j.snelders@xxxxxxxxxx]

Hi,

You can use editcap to remove the malformed packet:
editcap <infile> <outfile> <number of the packet you want to remove>

$ editcap temp.cap temp2.cap 10
Add_Selected: 10
Not inclusive ... 10

$ capinfos -c temp.cap temp2.cap
File name: temp.cap
Number of packets: 30

File name: temp2.cap
Number of packets: 29

Hope this helps
Joan

On Sun, 30 Aug 2009 11:46:22 +0200 samyc wrote:
>
>Hello,
>When reading a pcap with a malformed packet tshark stops to read the .pcap
>file.
>Is there a an option to tell tshark to conitnue .pcap analysis?
>BR