Wireshark-users: [Wireshark-users] Unrecognized libpcap format

From: Phillip Heller <pheller@xxxxxx>
Date: Fri, 19 Dec 2008 18:55:37 +0100
Hello,

  I'm attempting to do a remote capture as follows:

mkfifo /tmp/pipe
ssh -t host "sudo tshark -w - not port 22" >> /tmp/pipe

Then, I fire up Wireshark [Version 1.1.2 (SVN Rev 27060), running on Mac OS 10.5.6 linked against native GTK Quartz libraries. Point it at /tmp/pipe and start capture, at which point the ssh process prompts me for my password and I'm immediately told "Unrecognized libpcap format".

I can cat the pipe and get the very same data I get running tshark locally.

Any ideas?

--phil