Working with small pcap files

[RSAAdmin]

Hello,

I'm pretty new to investigator, and I'm encountering difficulties while working with very small pcap files.

The pcap files are created elsewhere, and sometimes they are very small, even just a few KBs, and have a very small number of packets in them.

Regardless of their size, I need to search these files for specific strings, and I wanted to do that using Investigator's search features.

But, when I load these files to a collection, Investigator just return an empty report and doesn't find anything when searching.

When loading the same files with Wireshark I can search the packets.

What can I do to make it work with Investigator?

Thanks.

[RSAAdmin]

Sorry to hear that you are having issues with Investigator.  There are no specific steps that you need to take with Investigator when working with small pcaps.  You can check the application log file from the Help menu for possible error messages.  Also, Investigator only supports packets with an outer Ethernet, 802.11, or SLL (Linux cooked capture) frame.  You can try importing a know supported pcap (such as http://wiki.wireshark.org/SampleCaptures?action=AttachFile&do=view&target=dns.cap) to validate that there are no issues with your installation of Investigator.

If you still have questions, feel free to include screenshots of Investigator and Wireshark.

[RSAAdmin]

I tried opening these pcap files with both the enterprise version and the freeware version of Investigator.

With the enterprise version it works great like with any other file, but the freeware version keeps returning an empty report.    Why is that happening?

[RSAAdmin · Accepted solution]

More than likely, the freeware version is older than the enterprise version.  You may have stumbled on a bug that has been fixed in the enterprise version or the enterprise version has support for your pcap and the freeware does not.

What is the reported version on the freeware and enterprise Investigator you are using?  You can get that from the Help | About menu.  Also, what type of pcap are you loading?