The capture file appears to be damaged or corrupt. (pcap: File has 65563-byte packet, bigger than..

[Vincent HUGUES]

Hello,

I'm having this error when I open a 60MB pcap file, captured via USBPcapCMD: The capture file appears to be damaged or corrupt. (pcap: File has 65563-byte packet, bigger than maximum of 65535)
I'm capturing a transfer of 60MB file on a USB  stick. This error appears when I transfer files that are more than a couple of MB on the USB stick.
I still can open the file in Wireshark but there is no info on the Data packets.

I don't have that problem when I transfer a 7KB file on the USB stick.

Do you have any idea where this comes from?

I'm using USBPcapCMD 1.0.0.4 version and Wireshark 1.11.0-SVN-49788 on Windows 7 x64.

Thanks,

Vincent.


 

[Tomasz Moń]

On Mon, Jun 10, 2013 at 8:21 PM, Vincent HUGUES <thef...@gmail.com> wrote:
> I'm having this error when I open a 60MB pcap file, captured via USBPcapCMD:
> The capture file appears to be damaged or corrupt. (pcap: File has
> 65563-byte packet, bigger than maximum of 65535)
> I'm capturing a transfer of 60MB file on a USB stick. This error appears
> when I transfer files that are more than a couple of MB on the USB stick.
> I still can open the file in Wireshark but there is no info on the Data
> packets.
>
> I don't have that problem when I transfer a 7KB file on the USB stick.
>
> Do you have any idea where this comes from?

That's a problem with Wireshark, I will reply to this post again when
it gets fixed.

By the way, USBPcap by default caps the packet to 65535 bytes (but
unfortunately, it doesn't help Wireshark at all). You should use -s
commandline option to specify bigger snaplen value. I will probably
raise it in next USBPcap release as I receive more and more reports
about big packets.

[Vincent HUGUES]

Ok, thank you.