Hi Guy, Thanks for your reply. What the "libpcap-format file header" looks like?
Regards Joyce -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Guy Harris Sent: Wednesday, January 03, 2007 2:44 AM To: Community support list for Wireshark Subject: Re: [Wireshark-users] captured file can not be understood by Tshark joyce wrote: > My system will generate monitor log file in both > ASCII(Monitor.log.1.zip) and pcap version(Monitor.pcap.1.00009) as > attached. Because the ASCII version log does suitable for extracting > information, I use tshark to decode the pcap version file and so far > works fine. However my system met a reboot a few days ago, and today the > monitor restart again and write to the log file from the point it > stopped last time. later I got the error when decoding this file. I > suspect it's caused by the system reboot during the process of log > writing, however I don't know what is missing in the log file that > tshark can not recognize the format. Wireshark give me the same error. So does tcpdump: $ tcpdump -r /tmp/Monitor.pcap.1.00009 tcpdump: bad dump file format What's missing is a valid libpcap-format file header. If your monitor software restarts, and starts writing to a log file, the new log file has to begin with a libpcap-format file header. _______________________________________________ Wireshark-users mailing list [email protected] http://www.wireshark.org/mailman/listinfo/wireshark-users _______________________________________________ Wireshark-users mailing list [email protected] http://www.wireshark.org/mailman/listinfo/wireshark-users
