Wireshark-users: [Wireshark-users] Tshark - Value to large for defined data type
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: mark-wade@xxxxxxxxxxx
Date: Thu, 17 Jun 2010 17:20:23 +0000 (UTC)

Hello,

 

I am trying to use Tshark to read about 19,000 15MB files to get some network statistics.  My plan (since Tshark can't read files out of a directory) is to use mergecap to break the large number of files into larger files.  Basically I merged 1000, 15MB into one large file and had about 20 of these.  I know that Mergecap cant handle large files without a workaround, which I have.  Problem is now that I have these 19 files that range from 3GB to 15GB and now when I run # tshark -r pcapfile -q -z io, phs  I get the error, The file pcapfile could not be opened: Value to large for defined data type.

 

Anythoughts?

 

Thanks,