How to open a file captured via snoop with Wireshark

[davidodav]

Hello,

   I do recently captured a traffic with snoop on ns-5400 firewall with firmware version 6.3.0r11.0. When ever I tried to open the file with wireshark , it just came up with an error message " the file is damaged....". I even copy and paste the output of " get db strea" on notepad and saved it with an extension of .pcap. So when I tried to open this .pcap file still there is the same error message. Do you guys have any idea on how I can open this snoop file using wireshark or any network protocol analyzer?

Thanks,

[BSOD]

Just ran into this very same bug in my thread - http://forums.juniper.net/t5/ScreenOS-Firewalls-NOT-SRX/ScreenOS-6-3-Connection-refused-by-the-DNS-s... 

Just created a bug with Wireshark - https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7340

[davidodav]

It looks like we have the same issue...please let me know if you get the solution.

Thanks,

[BSOD]

A Wireshark dev just fixed the code in SVN.  I don't feel compelled to do a win32 compile, so now we wait until it's included in the next release.

[davidodav]

...but I have tried the older version of wireshark and the same error message.....

[William]

SVN revision indicates it was an issue with the dash in the zone name. You might be able to edit the dash in the snoop output to a valid character.

[davidodav]

Can you please explain it what do you mean by valid character?..with an example (if you can though )

Thanks,

[William]

Change every occurrence of v1-untrust to v1funtrust for example. You would need to make this change for any zone with a dash in the name.