[Solved] Reading pcap files gives a error

[r]

Hello,

i have a pcap file exported from zscaler. when reading it into fiddler classic the error attached in the screenshot is displayed.

how can i solve it?

 

regards,

 

René

 

[Nick Iliev]

Hello,

 

The PCAPNG format is an updated version of PCAP, known as PCAP Next Generation, and differs from the traditional PCAP and CAP formats. One of its features allows the capture to be truncated, which likely happened in your case because the pcapng was recorded with a snaplen smaller than the full packet size. This is common with tools like Wireshark or tcpdump when a custom capture length is set. Packets are stored cut off, but the IP header still indicates the original full size. However, this can cause a compilation error in Fiddler, as it expects the original file size but receives only a partial chunk.

To fix this, try these options:

1. Open the pcapng file in Wireshark; it will mark truncated packets as [Packet size limited during capture]. Re-capture the traffic using the default (full) snaplen (use "-s 0" in tcpdump or select "Use maximum capture buffer size" in Wireshark), then reimport the new pcapng into Fiddler.

2. If that doesn't work, re-capture the traffic in supported formats like legacy cap or pcap, and then use those files in Fiddler.

 

Regards,
Nick Iliev
Progress Telerik