Free Online Analysis of PCAP Files (Linux)

Get a FREE automated analysis of Packet Capture (PCAP) files, to discover malicious activity, security vulnerabilities and other network events.


UPLOAD A PCAP FILE      SEE REPORT EXAMPLE

Top 20 tcpdump Errors and Solutions
# Error Message Explanation How to Resolve
1 eth0: You don't have permission to capture on that device User doesn't have permission to access the network interface. Run with sudo or add user to tcpdump group (if supported).
2 Can't open device eth0: No such device exists Interface name is incorrect or missing. Check with ip link or ifconfig for the correct name.
3 syntax error Invalid BPF filter expression. Check syntax. Use quotes and review man tcpdump.
4 pcap_loop: bogus savefile header The .pcap file is corrupted or in the wrong format. Try opening in Wireshark or re-capture the file.
5 truncated dump file; tried to read 24, only got 0 Partial or incomplete capture file. Re-acquire the file or check disk issues.
6 unknown protocol link type Unknown or unsupported link layer type. Update tcpdump/libpcap or try with Wireshark.
7 pcap_set_buffer_size: Cannot allocate memory Buffer size too large or system is low on memory. Reduce size using -B or increase system limits.
8 error reading from file: Bad file descriptor The capture file handle is invalid or closed. Ensure the file exists and restart the read.
9 packet printing is not supported for link type 147 The file uses a link type tcpdump doesn't support. Update tcpdump or use Wireshark for analysis.
10 listening on eth0, link-type EN10MB (Ethernet), snapshot length 262144 bytes This is an informational message, not an error. No action needed.
11 can't parse filter expression: syntax error Malformed capture filter string. Fix BPF filter syntax (e.g., remove = in expressions).
12 too many levels of remote in name Invalid or overly complex interface/hostname resolution. Use IP directly or simplify hostname configuration.
13 listening, but no packets captured No traffic matches the filter or the interface is wrong. Try using -i any or remove filters to verify.
14 can't parse capture filter: parse error Invalid BPF filter syntax. Simplify filters and test incrementally.
15 snoop: invalid packet capture file Trying to read a file that isn’t in pcap format. Check file type and ensure it's a valid capture.
16 socket: Operation not permitted User lacks permission to create raw socket. Run with sudo or assign CAP_NET_RAW capability.
17 compiled with version x of libpcap, but used with version y tcpdump and libpcap are from different versions. Reinstall both using the same package source.
18 file is not a pcap file Trying to read a non-capture file. Verify the file with file command and correct path.
19 Cannot open file: Permission denied User doesn’t have read access to the file. Change file permissions or use sudo.
20 warning: promiscuous mode not supported on this device Interface does not support promiscuous mode. Use -p to disable promiscuous mode or switch interface.