Re: Running tshark on large pcap files

[Christopher Maynard <Christopher.Maynard () gtech com>]

Evan Huus <eapache@...> writes:

> > And it also doesn't seem like I can split up the files with editcap.
> > Whenever I tried to do that with the large pcap files, I got empty output
> > files (24 bytes) instead. I'm not sure if it was due to the large file size.
>
> That's odd. If you can reproduce consistently (and perhaps with a
> smaller capture) please file a bug.

This might be bug 2868: https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2868

Did you try passing, "-F libpcap" to editcap?


___________________________________________________________________________
Sent via:    Wireshark-users mailing list <wireshark-users () wireshark org>
Archives:    http://www.wireshark.org/lists/wireshark-users
Unsubscribe: https://wireshark.org/mailman/options/wireshark-users
             mailto:wireshark-users-request () wireshark org?subject=unsubscribe