memsniff icon indicating copy to clipboard operation
memsniff copied to clipboard

Error reading pcap file

Open duxing opened this issue 6 years ago • 0 comments

Hi Box team,

I'm trying to use memsniff to parse traffic on my memcached server. Due to OS limitation I can't run memsniff directly on the server. Instead I'm looking into running memsniff somewhere else to read the captured pcap files.

however I ran into an error when reading the captured pcap file: Error from DecodeLayers: No decoder for layer type Unknown

no result is showing in memsniff and the last message I received is Reached EOF, waiting for workers to finish

command used to capture traffic: tcpdump -nnA -i any "dst port 11211" -s 0 -X -w output.pcap

command used for running memsniff: memsniff -r output.pcap

tcpdump is executed on a CentOS5 server, and memsniff is built & executed from my laptop (MacOS). I'm using the latest version (as this is written) of memsniff:

memsniff --version
2019/02/05 11:12:47.783652 memsniff version 1.4.0 (revision autopopulated by build.sh)

can you help me figuring out what I did wrong in using memsniff? the same pcap file can be opened fine in wireshark so I figured it's probably the way I used memsniff that's causing this issue.

thanks in advance!

duxing avatar Feb 05 '19 19:02 duxing