1

I am capturing traffic using wireshark. Everything works nice, but for some reason after I capture more than 2 mlns packets, wireshark just crashes.

I am not sure what can be the reason, but I tried it three times and every time soon after 2 mlns it crashes. So I am exporting the information every 1 something million packets by using File->Export->File then restarting the capture.

Everything works fine, but is there a way to automatically tell wireshark to Export and restart capture after specific amount of packets or may be specific time limit?

2
  • What OS is your capture platform"
    – Scott Pack
    Nov 22, 2012 at 19:18
  • Windows 7, but the same is happening on Ubuntu Nov 22, 2012 at 20:09

1 Answer 1

2

How much data is flowing across the link you're trying to monitor? Wireshark's primary job is to show you as much information as it can about every packet that it sees and it does this by default. If you're trying to dissect lots of packets in real time you can run out of memory very quickly.

There are a couple of ways around this:

  1. Within Wireshark's capture options, make sure "Update list of packets in real time" is disabled and that "Use multiple files" is enabled.
  2. Instead of using Wireshark use dumpcap. Dumpcap is much more efficient and it's what actually captures packets when you click the "capture" button in Wireshark.

BTW, you might want to save capture files using "Save". Depending on the file format you choose "File→Export" may save packets to a file that Wireshark can't read (hence the word "export").

2
  • Thanks for advice. 'Update list of packets was disabled' about 'Use multiple files' - can you point me where I can change it and what does it do? And for sure many thanks for showing dumpcap. Never heard about it. Nov 22, 2012 at 18:52
  • "Use multiple files" is one of the sections in the capture options. You can open the capture options via "Capture→Options" or by clicking on "Capture Options" in the welcome screen. Nov 23, 2012 at 1:42

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .