## Summary Hi, I am using two rotating logfiles to capture Bluetooth data. If both files reach their allowed size the first one will be overwritten, then the second, then again the first and so on. When I keep a SCO connection (e.g. HFP-AG profile) for a while, it is no longer possible to open the logfile in wireshark. It feels like this happens after the beginning of the SCO connection is overwritten. After a bit of try and error I think that the packet-types 0x08 and 0x09 trigger the issue. If I change them to, for example, 0x01 Wireshark can open it. Please check the attached files for an example. I extracted a single SCO packet for demonstration. ## Steps to reproduce Try to open the attached file BTLog_broken.pklg ## What is the current bug behavior? Wireshark reports: The file "BTLog_broken.pklg" isn't a capture file in a format Wireshark understands. ## What is the expected correct behavior? Even there is some missing information about the connection, I would assume that it still can be opened. ## Sample capture file [BTLog_broken.pklg](/uploads/54705f5ae09e5f71ab9d8bbb664b5af2/BTLog_broken.pklg) [BTLog_quickfix.pklg](/uploads/c011a1668e528e6d12dbaa8572328744/BTLog_quickfix.pklg) (Changed to 0x01) ## Relevant logs and/or screenshots  ## Build information Version 3.6.2 (v3.6.2-0-g626020d9b3c3) Copyright 1998-2022 Gerald Combs <gerald@wireshark.org> and contributors. License GPLv2+: GNU GPL version 2 or later <https://www.gnu.org/licenses/gpl-2.0.html> This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. Compiled (64-bit) using Microsoft Visual Studio 2019 (VC++ 14.29, build 30139), with Qt 5.15.2, with libpcap, with GLib 2.66.4, with zlib 1.2.11, with Lua 5.2.4, with GnuTLS 3.6.3 and PKCS #11 support, with Gcrypt 1.8.3, with MIT Kerberos, with MaxMind DB resolver, with nghttp2 1.44.0, with brotli, with LZ4, with Zstandard, with Snappy, with libxml2 2.9.10, with libsmi 0.4.8, with QtMultimedia, with automatic updates using WinSparkle 0.5.7, with AirPcap, with SpeexDSP (using bundled resampler), with Minizip. Running on 64-bit Windows 10 (21H1), build 19043, with AMD Ryzen 7 2700X Eight-Core Processor (with SSE4.2), with 32687 MB of physical memory, with GLib 2.66.4, with Qt 5.15.2, with Npcap version 1.55, based on libpcap version 1.10.2-PRE-GIT, with c-ares 1.17.0, with GnuTLS 3.6.3, with Gcrypt 1.8.3, with nghttp2 1.44.0, with brotli 1.0.9, with LZ4 1.9.3, with Zstandard 1.4.0, without AirPcap, with light display mode, without HiDPI, with LC_TYPE=German_Germany.utf8, binary plugins supported (21 loaded). Wireshark is Open Source Software released under the GNU General Public License. Check the man page and https://www.wireshark.org for more information.