Error reading pcap files

When processing pcap (Files captured with libpcap, E.g. tcpdump or whireshark) there are errors that can occur.

Damaged or incomplete pcap files


Error in TFileReader.ProcessFile(/opt/datatex/siprecord2/incoming/skywire220240204_080054.pcap): Error in /opt/datatex/siprecord2/temp/skywire220240204_080054.pcap at packet 18162: len > remaining file: 2772981 + 74 > 2772992

Error explained

  • This error states the file that was processed: /opt/datatex/siprecord2/incoming/skywire220240204_080054.pcap
  • It states that the error occurred on packet 18162.
  • The size of the file at the point where this packet is starting is given as 2772981
  • The size of the failing packet is given as 74.
  • The actual size of the file is given as 2772992
  • If the packet of 74 bytes is added to the 2772981 the size should be 2773055. There are 63 missing bytes from the file.

This can happen for a couple of reasons.

  1. The capture was stopped before the file was written out.
  2. The server ran out of space and there was not space to write the last couple of bytes.
  3. the server was rebooted while it was still writing and didn’t complete.


  • The Siprecorder usually will skip over this and continue to the next file.
  • A ticket will be created to indicate that this happened.
  • Usually after a server reboot you should get one of these tickets.
  • If you are getting repeated errors, there may be a disk space issue and multiple files are affected. Disk space issues must be addressed immediately, or recordings will be affected.