Wireshark-users: Re: [Wireshark-users] can't read file

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 29 May 2008 09:33:42 -0700
Jeff Morriss wrote:

I beg to differ with the last statement. I frequently receive "damaged" files (it never ceases to amaze me) and I can frequently (but not always) repair them:

- open the file in my favorite 8-bit-clean editor[1]
- global-search-and-replace "^M$" (the Ctrl-M must be entered "Ctrl-V Ctrl-M") with nothing (empty string)
- save and quit

9+ times out of 10 it works.

9+ != 10; yes, if *all* occurrences of 0x15 0x12 in the file are the result of a 0x12 in a capture file on a UN*X system being turned to 0x15 0x12 as a result of transferring the file in ASCII mode to a Windows system - i.e., if, for example, the capture file has no HTTP or FTP or Telnet sessions with CR/LF in the data being transferred - then replacing all occurrences of 0x15 0x12 with 0x12 will undo the damage, but that can't be guaranteed.