Ethereal-users: [Ethereal-users] Reading etherpeek captures

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: "David Kuder" <david.kuder@xxxxxxxxxx>
Date: Mon, 12 Nov 2001 17:21:56 -0800
I was given two captures from etherpeek.  When I try to open
them I just see 7 packets that are really wrong.  The person
who did the capture assures me that etherpeek saw dozens of
packets.

The seven packets are all decoded as "UNKNOWN" protocol and
"WTAP_ENCAP = 0x0" in the info field.  It thinks the last
packet is incomplete but the others are seen as 66 bytes.

I would attach one at 37KB but it has account and passwords
in it.

Capture platform was Win2k running etherpeek unknown 4.1.
Decode platform is windows 98 running ethereal 0.8.20