Prashanth wrote: > Yes, i stop the trace on the filer before reading the file.
Then there's a bug on the filer; you should report it to NetApp. It might not be writing out the last bufferful of packet data (which means there might be some packets that are *completely* missing from the file). > If wireshark > ignores the packet then why doesn't it print the ip_hosts stats? Is > that the expected behavior? I normally use the -q because i am more > interested in looking at the stats by IP address. When wireshark finds > that a packet ( the last one) is cut short, it doesnt print the stats. > Is there a way to have it continue to print stats. You can throw away the incomplete packet at the end - have editcap read the file and write it to another file; it'll print an error, but it'll just copy the complete packets to the output file. Then read the output file with tshark. _______________________________________________ Wireshark-users mailing list Wireshark-users@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-users
