prashanth joshi wrote:
First I do "follow tcp stream" and save the file. And then I am running
the decoder on that file. But I am getting the error message as, "Error
could not open pcap stream [Bad dump file format]. "
What may be the error in the above?
Regards,
Prashanth
The file you saved from "follow tcp stream" is the contents of the TCP
stream, not the packets that were used to create said stream. If it was
a TCP stream used by a web server, for example, you'd be better off
viewing it with some kind of ASCII viewer (like vi or Notepad).