0

I am attempting to use the sngrep utility on a Mac OSX El Capitan 10.11.4 and getting an error when I try to open any pcap file.

The error is as follows:

Johns-MacBook-Pro:Downloads gojira$ sngrep -I 12345.pcap Couldn't open pcap file 12345.pcap: unknown file format

Does anyone know why this is happening and how I can get this to work properly? I have been able to open other pcap files before without this issue.

Improve this question
2
  • What does the command file 12345.pcap print?
    – user164970
    Apr 25, 2016 at 21:32
  • 12345.pcap: gzip compressed data, from Unix
    – THE DOCTOR
    Apr 25, 2016 at 22:19

1 Answer 1

Reset to default
0

That's a gzipped (compressed) pcap file, or possibly a gzipped pcapng file. Wireshark/TShark can read those files, but programs such as sngrep, which use libpcap/WinPcap, can't do so unless they do the uncompression themselves, and sngrep doesn't.

Rename it to 12345.pcap.gz, and then do gunzip 12345.pcap.gz; that'll uncompress it into a file named 12345.pcap, which will probably be a pcap or pcapng file, either of which OS X 10.11.4's libpcap can read.

Improve this answer
1
  • Thank you! Interesting problem. I'm going to write a shell script since I want to use sngrep more often and need to look at pcaps that happen to be compressed like this.
    – THE DOCTOR
    May 3, 2016 at 4:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .