Wireshark and tshark should dissect all the packets. Wireshark and tshark become completely non-responsive when they encounter certain packet payloads. When the smtp dissector is enabled, Wireshark or tshark will need to be terminated manually (Ctrl-C, Ctrl-Break, abort, Force Quit, TaskManager, etc).

% tshark -enable-protocol smtp -r packet_that_causes_the_sharks_to_lock_up.pcap.% wireshark -enable-protocol smtp -r packet_that_causes_the_sharks_to_lock_up.pcap.Now attempt to read the pcap with the smtp dissector enabled: % tshark -disable-protocol smtp -r packet_that_causes_the_sharks_to_lock_up.pcap.% wireshark -disable-protocol smtp -r packet_that_causes_the_sharks_to_lock_up.pcap.When working with the attached pcap file (packet_that_causes_the_sharks_to_lock_up.pcap), the non-responsive behavior is easier to deal with if Wireshark or tshark is started in a CLI:įirst verify that the pcap can be successfully displayed if the 'smtp' dissector is disabled: One must use a version of Wireshark that includes commit bf26f538 - 'wiretap: Do not silently limit capture length'. Wireshark and tshark become non-responsive when reading certain types of packets.

Tshark read pcap