CODEWITHSUNDEEP
wiresharktshark
user1710944
user1710944

Reputation: 1459

The capture file appears to have been cut short in the middle of a packet - how to prevent this error?

in my application i am open Tshark process and start capturing, when i want to finish to capturing i am kill the Tshark process so sometimes the capture file is corrupted and when i am trying to open this file i received the error the capture file appears to have been cut short in the middle of a packet - how to prevent this error there is a batter way to close the Tshark process to avoid this error ?

Upvotes: 6

Views: 30995

Answers (4)

Tayoou
Tayoou

Reputation: 1

Same problem when i use tshark to read FileCapture.
I find a solution in the tshark website and it's useful for me.
You can try to use "reordercap" to fix your packets. Here is usage:

reordercap your_source.pcap temp.pcap

However, I don not know if "reordercap" will have any effect on the packets. So be careful.

Here is the webpage of tshark: tshark webpage

Upvotes: 0

Ericle
Ericle

Reputation: 1

I know this post is old, but in case anyone else runs across this:

The OP is probably running something like this:

tshark > capture.cap

And then killing it with CTRL+C. This will corrupt the file.

Instead of redirecting the output, use the -w option:

tshark -w capture.cap

Then you can kill it with CTRL+C and shouldn't have any corruption issues.

Upvotes: -3

user862787
user862787

Reputation:

If this is on UN*X, if you kill the process with kill -INTpid, then that will look just like a Ctrl+C. I'm not sure there's an equivalent on Windows.

Upvotes: 1

SidR
SidR

Reputation: 2954

Try stopping the capture process with ctrl+c instead of killing the process.

Also, you can try using pcapfix to fix your corrupted packets, it may help making your existing files readable again.

Upvotes: 7

Related Questions