That's the wrong way to use it.

"sysdig -w" switch will generate a binary dump (in a pcap format) containing the "raw events" coming from the kernel (plus a snapshot of information gathered from /proc), so it's not supposed to be human-readable, you have to use "sysdig -r" on the dump file to get the output.

If you're used to tcpdump, it's the same thing.

My bad, works well with -r

`less -R`?