TShark seems to have crashed (retcode: 2). Try rerunning in debug mode [ capture_obj.set_debug() ] or try updating tshar

[seanachao]

my code example1

        caps = pyshark.FileCapture(self.filename)
        caps.set_debug()
        #self.caps_len = len(caps)
    
        src_host = ""
        dst_host = ""
        flow_packet = 0
        flow_bytes = 0
        index = 0 
        for counter,packet in enumerate(caps):
            if 'tcp' in dir(packet):
                #print(packet.tcp.stream)
                print(counter)
                src_host = packet.ip.src
                dst_host = packet.ip.dst
                flow_packet += 1
                flow_bytes += int(packet.tcp.len,10)
                if packet.tcp.stream not in self.features:
                    self.features.update({packet.tcp.stream:[src_host,dst_host,flow_packet,flow_bytes]})
                else:
                    self.features[packet.tcp.stream][2]+=1  #ToDoList
                    self.features[packet.tcp.stream][3]+=flow_bytes
                    pass #todo list

        return src_host,dst_host,flow_packet,flow_bytes

there was wrong

TShark seems to have crashed (retcode: 2). Try rerunning in debug mode [ capture_obj.set_debug() ] or try updating tshar

but if I use code example2

    file = './peer0.org1.pcap'
    cap = pyshark.FileCapture(file)
    #cap.load_packets(timeout=100000000)
    #cap.set_debug()
    for counter, pkt in enumerate(cap):
        if "tcp" in dir(pkt):
            print(pkt.tcp.stream)
            print(counter)

there not any wrong , what should I do my example1 could work normal?

[emptymo]

I have the same problem :(

[luoyexiaohe]

same problem but happened on sniff method

[GiovanniColonni]

Same problem here when reading a capture with FileCapture

[luoyexiaohe]

gays, I know how to deal with this. call the function named set_debug ,then you could see what's the problem in console. my problem is that my wireshark is break. when I install it again , problem gone . good luck !

[wangzeyu9766]

You need version correspondence me ： Wireshark-win64-2.4.2/ pyshark==0.4.2.7 This error will also occur if you illegally block and intercept good luck！

[vladenache13]

Is there any mapping for Wireshark-Version / pyshark_version compatibility?

[herugen]

same question. It turns out that the pcap file was appears to have been cut short in the middle of a packet.. This should not cause a crash, pyshark should just ignore the notice.

[sindhuh1]

Same issue, need support in handling this error "appears to have been cut short in the middle of a packet"

[sindhuh1]

gays, I know how to deal with this. call the function named set_debug ,then you could see what's the problem in console. my problem is that my wireshark is break. when I install it again , problem gone . good luck !

does this mean you reinstalled wireshark and the issue is fixed after that?

[luoyexiaohe]

gays, I know how to deal with this. call the function named set_debug ,then you could see what's the problem in console. my problem is that my wireshark is break. when I install it again , problem gone . good luck !

does this mean you reinstalled wireshark and the issue is fixed after that?

yes

[luoyexiaohe]

gays, I know how to deal with this. call the function named set_debug ,then you could see what's the problem in console. my problem is that my wireshark is break. when I install it again , problem gone . good luck !

does this mean you reinstalled wireshark and the issue is fixed after that?

but U should call the function first ,and get what's the problem with you.