Wireshark-users: Re: [Wireshark-users] "cut short in the middle of a packet" issue

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Mon, 21 May 2007 12:37:04 -0700
Prashanth wrote:

Yes, i stop the trace on the filer before reading the file.
Then there's a bug on the filer; you should report it to NetApp.  It 
might not be writing out the last bufferful of packet data (which means 
there might be some packets that are *completely* missing from the file).
If wireshark ignores the packet then why doesn't it print the ip_hosts stats? Is that the expected behavior? I normally use the -q because i am more interested in looking at the stats by IP address. When wireshark finds that a packet ( the last one) is cut short, it doesnt print the stats. Is there a way to have it continue to print stats.
You can throw away the incomplete packet at the end - have editcap read 
the file and write it to another file; it'll print an error, but it'll 
just copy the complete packets to the output file.
Then read the output file with tshark.