Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

1) I am trying to do long running monitoring of my network connection using my desktop computer but if the computer gets shut down without first properly exiting the network monitoring program then the .cap file gets corrupted and I am unable to pull useful data from it.

2) I am looking for a network monitoring tool (like Wireshark, or Microsoft Network Monitor, etc) that will successfully write a (non-corrupted) capture file to disk even if the application is killed inadvertently. The capture program might die inadvertently due to the machine running out of RAM, a system crash, a reboot caused by Windows Update or some other reboot, etc. Basically, the program will need to either stream the data to disk as a .cap file as it is received, or possibly use a different file format - perhaps something that is human readable like a text file so that even if the file is technically corrupted I will still be able to read it myself via a text editor.

3) Using a capture "chain" where the chain files are small does not work for me because I need to see the very last little bit of data. Capturing most of the data but then losing the last bit of data does not get me what I need. I need to be able to inspect the last bit of data that is sent over the wire to see if that data is what is causing the crash / reboot.

4) Alternatively, a tool that can successfully take a corrupted .cap file and fix the file would also work.

5) I can't use a network device to monitor the traffic, the solution needs to be software that runs on a Windows 7 64bit desktop computer.

share|improve this question
add comment

closed as off topic by Zoredache, EEAA, HopelessN00b Genius of network, rnxrx, John Gardeniers Oct 26 '12 at 9:06

Questions on Server Fault are expected to relate to professional server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer

up vote 1 down vote accepted

Use tshark and setup tshark to frequently switch to a different new file. This way you don't lose your entire capture, but possibly just a small portion of the more recent stuff. There are many options to set how often a new file should be used.

Then simply read in or merge all the files together as needed when doing analysis.

share|improve this answer
    
Thank you for the fast response. Unfortunately this doesn't work for me because I need to very last bit of data which may in fact be causing the reboot / crash and I need to inspect that data to see why this is happening. I will try to update my question to reflect this additional information. –  user1754662 Oct 25 '12 at 19:56
3  
If the system is crashing then you really can't expect to get valid data saved to the drive right during the crash. You may need to setup another machine as a bridge and connect your computer to it. Then do your monitoring on the bridge. –  Zoredache Oct 25 '12 at 19:58
    
Thanks for the response again. I understand what you are saying - this is why I am having a problem in the first place. I am pretty sure though that it is a reboot. (or slightly delayed crash - ie there is a window of time after the data is received before the machine reboots / crashes) So, the program needs to be able to write the data in the short amount of time while Windows is trying to shut down. –  user1754662 Oct 25 '12 at 20:03
    
Thanks again for the help. I am going to go with your answer and make the individual cap files in the chain very small. I am still concerned that I could miss the data if I don't make the file size small enough, but I don't way to make them too small and end up with a million small capture files. (mostly I am worried about running into an OS limitation of trying to make too many files in one directory) Thanks again. –  user1754662 Oct 25 '12 at 20:34
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.