Quick hack to fix len and caplen in pcap_pkthdr for PCAPs generated
by tcpdump with the bug libpcap version 1.5.3 causes the creation of invalid pcap files with packet length < capture length when capturing on the "any" interface.
The fix is to set caplen to len if caplen is larger then len.
sh autogen.sh
./configure
make
make install
cat file.pcap | ditl-fix-pcap-header-len-caplen > fixed.pcap
You can pipeline compression also:
gzip -cd file.pcap.gz | ditl-fix-pcap-header-len-caplen | gzip > fixed.pcap.gz