title: pcap2har for a pcap that was generated by tshark(-w option)
body: <p>My pcap file is generated via a command like: </p>
  
  <pre><code>cmd = """tshark -r "%s" -R "frame.time_relative &gt;= %f" -w "%s" """ % (pcap_name, first_dns_query_time, normalized_pcap_name)
  subprocess.Popen(cmd)
  </code></pre>
  
  <p>And that normalized pcap is given input to <a href="https://github.com/andrewf/pcap2har" rel="nofollow">pcap2har</a>. I get this error:</p>
  
  <pre><code>Traceback (most recent call last):
    File "main.py", line 65, in &lt;module&gt;
      dispatcher = pcap.EasyParsePcap(filename=inputfile)
    File "/path/to/pcap2har/pcap2har/pcap.py", line 80, in EasyParsePcap
      ParsePcap(dispatcher, filename=filename, reader=reader)
    File "/path/to/pcap2har/pcap2har/pcap.py", line 27, in ParsePcap
      pcap = ModifiedReader(f)
    File "/path/to/pcap2har/pcap2har/pcaputil.py", line 105, in __init__
      raise ValueError, 'invalid tcpdump header'
  ValueError: invalid tcpdump header
  </code></pre>
  
  <p>The portion of <code>pcaputil.py</code> that throws the error is:</p>
  
  <pre><code>    elif self.__fh.magic != dpkt.pcap.TCPDUMP_MAGIC:
          raise ValueError, 'invalid tcpdump header'
  </code></pre>
  
  <p>For my pcap(and for any pcap generated by the tshark command), <code>self.__fh.magic</code> is <code>168627466</code> and <code>dpkt.pcap.TCPDUMP_MAGIC</code> is <code>2712847316</code>.</p>
  
  <p>I commented the line that throws exception in <code>pcaputil.py</code> but after that I get this:</p>
  
  <pre><code>Traceback (most recent call last):
    File "main.py", line 65, in &lt;module&gt;
      dispatcher = pcap.EasyParsePcap(filename=inputfile)
    File "/path/to/pcap2har/pcap2har/pcap.py", line 80, in EasyParsePcap
      ParsePcap(dispatcher, filename=filename, reader=reader)
    File "/path/to/pcap2har/pcap2har/pcap.py", line 27, in ParsePcap
      pcap = ModifiedReader(f)
    File "/path/to/pcap2har/pcap2har/pcaputil.py", line 108, in __init__
      self.dloff = dpkt.pcap.dltoff[self.__fh.linktype]
  KeyError: 4294967295L
  </code></pre>
  
  <p>I have already submitted the issue <a href="https://github.com/andrewf/pcap2har/issues/21" rel="nofollow">on github</a></p>