joyce wrote:
My system will generate monitor log file in both
ASCII(Monitor.log.1.zip) and pcap version(Monitor.pcap.1.00009) as
attached. Because the ASCII version log does suitable for extracting
information, I use tshark to decode the pcap version file and so far
works fine. However my system met a reboot a few days ago, and today the
monitor restart again and write to the log file from the point it
stopped last time. later I got the error when decoding this file. I
suspect it�s caused by the system reboot during the process of log
writing, however I don�t know what is missing in the log file that
tshark can not recognize the format. Wireshark give me the same error.
So does tcpdump:
$ tcpdump -r /tmp/Monitor.pcap.1.00009
tcpdump: bad dump file format
What's missing is a valid libpcap-format file header. If your monitor
software restarts, and starts writing to a log file, the new log file
has to begin with a libpcap-format file header.