Wireshark-users: Re: [Wireshark-users] *.pcap file?
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Sat, 25 Aug 2012 23:22:21 -0700
On Aug 25, 2012, at 8:56 PM, hadi motamedi wrote:

> Please be informed that the outputs are as the followings :

	...

> # od -bc /tmp/mss0-pps.pcap | head
> 0000000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000 000
> \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0  \0
> *

That is not even remotely close to being a pcap file.  I have *no* idea what programs other than tcpdump wrote to that file, but either

	1) you have a very buggy version of tcpdump on your machine;

	2) tcpdump is using a very buggy version of libpcap on your machine;

	3) some *other* program wrote to that file and damaged it beyond repair.

In any case, there is almost certainly nothing you can do to get packet data from that capture.  I would suggest that you delete the file, try another capture, and if the same problem occurs, file a bug with the CentOS developers.