[Guy Harris <gharris@xxxxxxxxxxxx>]

> That's because the file appears to be damaged or corrupt after the
> eighth frame; after gunzipping it, if I try to run "tcpdump" on it, I
> get:
> 
> 	tcpdump: pcap_loop: bogus savefile header
> 
> so it's not as if it's just Ethereal that doesn't like it.

The file appears to have had one byte removed from it at an offset of
0x369; the libpcap header for the packet that would include that byte
implies that it's 89 bytes long, and the IP header's total length field
is 75, and it's an Ethernet packet so the MAC header is 14 bytes, and
75+14 = 89, but the byte in question is part of the beginning of the
next packet's libpcap header.