Wireshark-users: Re: [Wireshark-users] network monitor 3.4 traces cannot be read

Date: Fri, 23 Jul 2010 12:15:23 +0100
On 22/07/2010 15:59, Graham Bloice wrote:
For what its worth, I just installed NM 3.4 to capture traffic over an MS VPN which WinPCap can't handle. Capture is fine, but NM doesn't have the protocol decoder I need (DNP3) so I tried to open the file in Wireshark 1.5.0-SVN-33615 (Win7 x64) and got the error dialog "The capture file has a packet with a network type that Wireshark doesn't support. (netmon: network type 0 unknown or unsupported)".

I can make the capture available if folks want, I'm not in a position to look at this myself at the moment. I presume the issue might be to do with the capture being from a VPN adaptor.

My understanding is that the capture format changes if you have more than one active and selected network connector in the capture, so it can differentiate between which board produced which packet. I could be wrong of course :)