LetMeSOThat4U
LetMeSOThat4U

Reputation: 6796

Checking if pcap file is damaged (with tshark or possibly something else)

I have a very specific need regarding pcap files generated by wireshark or similar: I need to test quickly if specific pcap file is damaged. Say, if first 100 packets are written correctly to it.

I have tshark available on hosts where files will be used.

The problem: we're using a lot of pcap files and unfortunately some of them get corrupted for reasons I won't get into. I need to do quick sanity check of a file before it being tcpreplayed. I don't need to eliminate absolute 100% of them, just obviously and grossly corrupted ones.

Upvotes: 0

Views: 59

Answers (0)

Related Questions