ASA capture files not being read by Wireshark

Answered Question
Aug 20th, 2009

I took some capture files this morning on our ASA appliance. I actually view the packets being captured with the real time command. Once I had what I needed, I ended the capture. I then FTP the trace files to my workstation, opened Wireshark to then point to the files. I keep getting this message when I try to open the files::The file "C:\FTProot\lori_ip" isn't a capture file in a format Wireshark understands. I have tried using both a .pcap and a .cap extension. I am still getting the same error message.

Wireshark is opening other files just fine.

Correct Answer by robertson.michael about 7 years 6 months ago

Hi Kevin,

Using the capture command, the syntax would look like this:

copy /pcap capture:[context/]

Here is a link to the command reference also:

Hope that helps.


  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Kevin Redmon Thu, 08/20/2009 - 13:39

When transferring the capture files, you must be sure to leverage the '/pcap' parameter to copy the file as a valid *.pcap file. You probably downloaded the file as the textual version. You may still be able to glean some information from the file if you open it within a text viewer.

You can also download the files leveraging the following URL:


Here's a helpful link for the packet capture feature:

Kevin Melton Thu, 08/20/2009 - 13:53

I am still having difficulty "leveraging" with the "/pcap" parameter. Where exactly in the copy command does it belong. I have tried it everywher and the ASA is just not liking it...


This Discussion