# Suricata Error while processing PCAP

**URL:** https://forum.suricata.io/t/suricata-error-while-processing-pcap/2479
**Category:** Help
**Created:** [May 7, 2022, 7:18pm UTC](https://forum.suricata.io/t/suricata-error-while-processing-pcap/2479 "2022-05-07T19:18:14Z")
**Posts on this page:** 2
**Page:** 1

<div class="post-metadata">

### Author: ![Shashwat\_Adhikari](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/shashwat_adhikari/32/1427_2.png) [@Shashwat\_Adhikari](https://forum.suricata.io/u/Shashwat_Adhikari)
#### Post date: [May 7, 2022, 7:18pm UTC](https://forum.suricata.io/t/suricata-error-while-processing-pcap/2479/1 "2022-05-07T19:18:14Z")

</div>

Hi, I am trying to process a large pcap file (~30 GB), but it throws this error:

- [ERRCODE: SC\_ERR\_PCAP\_OPEN\_OFFLINE(26)] - failed to get first packet timestamp. pcap\_next\_ex(): -1

 ![image](https://canada1.discourse-cdn.com/flex030/uploads/suricata/original/2X/4/417a9095920a8e2a4e7b1ae4cc00d017567a41e6.png)

I was told this pcap file was merged from multiple small ones, I don’t know if that could create any problems.

---

<div class="post-metadata">

### Author: ![suricatalfon](https://yyz2.discourse-cdn.com/flex030/user_avatar/forum.suricata.io/suricatalfon/32/385_2.png) [@suricatalfon](https://forum.suricata.io/u/suricatalfon)
#### Post date: [May 9, 2022, 5:00am UTC](https://forum.suricata.io/t/suricata-error-while-processing-pcap/2479/2 "2022-05-09T05:00:24Z")

</div>

Hi,

It is possible that the pcap file has a problem because of what you mention. You can use to repair it:

pcapfix

> **[pcapfix - repair corrupted pcap / pcapng files](https://f00l.de/pcapfix/)**
>
> pcapfix repairs corrupted pcap and pcapng files