The capture file appears to have been cut short in the middle of a packet - how to prevent this error?

Question

in my application i am open Tshark process and start capturing, when i want to finish to capturing i am kill the Tshark process so sometimes the capture file is corrupted and when i am trying to open this file i received the error the capture file appears to have been cut short in the middle of a packet - how to prevent this error there is a batter way to close the Tshark process to avoid this error ?

Answer 1

Try stopping the capture process with ctrl+c instead of killing the process.

Also, you can try using pcapfix to fix your corrupted packets, it may help making your existing files readable again.