# Problem reading pcap file

**URL:** <https://community.zeek.org/t/problem-reading-pcap-file/3315>\
**Category:** Zeek\
**Created:** [October 20, 2014, 2:19am UTC](https://community.zeek.org/t/problem-reading-pcap-file/3315 "2014-10-20T02:19:08Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Vladimir\_Arseniev](https://avatars.discourse-cdn.com/v4/letter/v/e9a140/32.png) [@Vladimir\_Arseniev](https://community.zeek.org/u/Vladimir_Arseniev)\
**Post date:** [October 20, 2014, 2:19am UTC](https://community.zeek.org/t/problem-reading-pcap-file/3315/1 "2014-10-20T02:19:08Z")

</div>

While this is fundamentally an old question, the old answers aren't  
working for me. Using "bro -r", I get the classic "invalid UDP  
checksums" error. Using "bro -rC" (or "bro -r -C"), I get numerous  
errors about unrecognized characters (even with the "-r" flag).

Using "bro -Cr" (or "bro -C -r"), I get no shell errors. However, I see  
just 13 packets in "conn.log" vs 24311 packets expected. Perhaps this is  
the new piece of my question (plus why "-rC" \<\> "-Cr").

How do I fix this?

Some details might be useful. I compiled from bro-2.3.1.tar.gz in Debian  
7.6 x64. I'm working with a 32MB capture from a Centos 6.5 VPS. I used  
dumpcap with a ring buffer:

dumpcap -b filesize:102400 -b files:10 -i eth0 -w /home/user/eth0

I used Wireshark to restrict eth0\_00001\_20141014111022 to IPv4, yielding  
eth0\_00001\_20141014111022\_IPv4. Then I used "editcap -F libpcap" to  
convert to eth0\_00001\_20141014111022\_IPv4.pcap (hereinafter "eth0.pcap").

I get no joy reading eth0.pcap with bro:

bro -r eth0.pcap  
1413340801.822519 warning in  
/usr/local/bro/share/bro/base/misc/find-checksum-offloading.bro, line  
54: Your trace file likely has invalid UDP checksums, most likely from  
NIC checksum offloading.

bro -rC eth0.pcap  
error in ./eth0.pcap, line 1: unrecognized character -  
...  
error in ./eth0.pcap, line 1: unknown identifier t, at or near "t"

bro -Cr eth0.pcap  
[completes without errors, but conn.log is just 2.4KB]

cat conn.log  
[see expected headers, but just 13 data lines]  
#close 2014-10-19-20-26-47

---

<div class="post-metadata">

**Author:** ![anthony\_kasza1](https://avatars.discourse-cdn.com/v4/letter/a/dfb087/32.png) [@anthony\_kasza1](https://community.zeek.org/u/anthony_kasza1)\
**Post date:** [October 20, 2014, 3:43am UTC](https://community.zeek.org/t/problem-reading-pcap-file/3315/2 "2014-10-20T03:43:52Z")

</div>

Are you willing to share a sample pcap that causes these errors?

-AK

---

<div class="post-metadata">

**Author:** ![Vladimir\_Arseniev](https://avatars.discourse-cdn.com/v4/letter/v/e9a140/32.png) [@Vladimir\_Arseniev](https://community.zeek.org/u/Vladimir_Arseniev)\
**Post date:** [October 20, 2014, 4:53am UTC](https://community.zeek.org/t/problem-reading-pcap-file/3315/3 "2014-10-20T04:53:57Z")

</div>

> Are you willing to share a sample pcap that causes these errors?
> 
> -AK

Thank you. That was the perfect answer, because it led me to excerpt one  
conversation with a nonsensitive host. And reading that yielded a  
"conn.log" with just one line. [zap!]

It's classic PEBKAC 😉 Conversations \<\> packets.

There are \_only 13\_ conversations in that capture. It's a bandwidth  
test, and ten of them are http with resp\_bytes=1520560.

Excuse: I've been reading about both Bro and Splunk, and got confused.

---

<div class="post-metadata">

**Author:** ![system](https://canada1.discourse-cdn.com/flex011/uploads/zeek/original/1X/f09d732bc2cc7c7cc7e35db67cf4e1d5233ce7a7.png) [@system](https://community.zeek.org/u/system)\
**Post date:** [May 6, 2022, 3:42pm UTC](https://community.zeek.org/t/problem-reading-pcap-file/3315/4 "2022-05-06T15:42:09Z")

</div>

Closed on May 6, 2022, 3:42pm UTC