Re: [Wireshark-users] Can't open PCAP file via GUI

2007-02-14 Thread Hans Nilsson
Well if the file is empty it obviously wasn't created or transfered properly and doesn't contain any data or anything valid for Wireshark to read. On Thu, 15 Feb 2007 00:55:20 +, "Donald Musser" <[EMAIL PROTECTED]> said: > When I performed the original tcpdump on my production server, I did u

Re: [Wireshark-users] Can't open PCAP file via GUI

2007-02-14 Thread Guy Harris
On Feb 14, 2007, at 4:55 PM, Donald Musser wrote: > When I performed the original tcpdump on my production server, I did > use the -w option. I then used Konqueror to transfer the file to my > local CentOS machine. So perhaps the file was mangled somehow, as > you said? How did you transfe

Re: [Wireshark-users] Can't open PCAP file via GUI

2007-02-14 Thread Donald Musser
When I performed the original tcpdump on my production server, I did use the -w option. I then used Konqueror to transfer the file to my local CentOS machine. So perhaps the file was mangled somehow, as you said? I did note upon re-examining the file that it was empty. Perhaps this also is lendin

Re: [Wireshark-users] Can't open PCAP file via GUI

2007-02-14 Thread Guy Harris
On Feb 14, 2007, at 4:00 PM, Donald Musser wrote: > I've done a yum install of wireshark and the wireshark-gnome > programs. When I run wireshark from command line, the gui pops up, > but when I try to open a PCAP file that I previously captured on a > separate box using my tcpdump command,

[Wireshark-users] Can't open PCAP file via GUI

2007-02-14 Thread Donald Musser
Hi all, I've done a yum install of wireshark and the wireshark-gnome programs. When I run wireshark from command line, the gui pops up, but when I try to open a PCAP file that I previously captured on a separate box using my tcpdump command, the program errors out and tells me the file is in a fo

Re: [Wireshark-users] saving "decode as" settings

2007-02-14 Thread Andy Howell
Douglas Pratley wrote: > Hi Andy > >> Thanks. Took a look at the wishlist. Closest thing was >> saving preference. I had a quick look through the Lua >> bindings, but did see a way to set a dissector for a particular port. >> > > Sorry, but did you mean "didn't" here? I can't see an exact

Re: [Wireshark-users] saving "decode as" settings

2007-02-14 Thread Douglas Pratley
Hi Andy > > Thanks. Took a look at the wishlist. Closest thing was > saving preference. I had a quick look through the Lua > bindings, but did see a way to set a dissector for a particular port. > Sorry, but did you mean "didn't" here? I can't see an exact example myself; I think there

Re: [Wireshark-users] saving "decode as" settings

2007-02-14 Thread Andy Howell
Douglas Pratley wrote: > Hi Andy > > I'm afraid that there is not (even in more recent versions). > > I suggest that you check the Wishlist (wiki.wireshark.org/Wishlist) and > the bug list (bugs.wireshark.org/bugzilla) to see if it is present as an > enhancement request. > > Then mail the develo

Re: [Wireshark-users] Gtk-WARNING **: cannot open display:

2007-02-14 Thread Robert D.
Andreas Fink said the following: > Note: the easiest way to start wireshark is to type > /usr/local/bin/wireshark thanks for jumping in and answering ... and thanks for the 'port' also. -- Mac OS/X 10.4.8 Macbook Pro 2.16 Intel Core Duo wireshark 0.99.5 X11 1.1.3 - XFree86 4.4.0 Darwin __

Re: [Wireshark-users] saving "decode as" settings

2007-02-14 Thread Douglas Pratley
Hi Andy I'm afraid that there is not (even in more recent versions). I suggest that you check the Wishlist (wiki.wireshark.org/Wishlist) and the bug list (bugs.wireshark.org/bugzilla) to see if it is present as an enhancement request. Then mail the developers list and see if anyone is working on