Mac wireshark capture files fail
Brought to you by:
chrismorgan,
tamirgal
Menu
▾
▴
EXkIzr hmjlannjcwve, [url=http://ydgxggjjkgyp.com/]ydgxggjjkgyp[/url], [link=http://hiymzcktdhrp.com/]hiymzcktdhrp[/link], http://pebirzzwfeom.com/
This sounds like an issue with libpcap/winpcap. Have you contacted them to see whether this is expected behavior?
It's expected behavior with libpcap prior to 1.1. WinPcap 4.1.3 is based on libpcap 1.0.
The problem is that Wireshark now defaults - on all platforms, not just OS X - to writing out pcap-ng files rather than pcap files. libpcap 1.1 and later can read some pcap-ng files (it can't read files with captures from interfaces that don't all have the same link-layer type, as the libpcap API currently doesn't support that), but libpcap 1.0.x and earlier can't read them.