Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am capturing traffic using wireshark. Everything works nice, but for some reason after I capture more than 2 mlns packets, wireshark just crashes.

I am not sure what can be the reason, but I tried it three times and every time soon after 2 mlns it crashes. So I am exporting the information every 1 something million packets by using File->Export->File then restarting the capture.

Everything works fine, but is there a way to automatically tell wireshark to Export and restart capture after specific amount of packets or may be specific time limit?

share|improve this question
    
What OS is your capture platform" –  Scott Pack Nov 22 '12 at 19:18
    
Windows 7, but the same is happening on Ubuntu –  Salvador Dali Nov 22 '12 at 20:09
add comment

1 Answer

up vote 2 down vote accepted

How much data is flowing across the link you're trying to monitor? Wireshark's primary job is to show you as much information as it can about every packet that it sees and it does this by default. If you're trying to dissect lots of packets in real time you can run out of memory very quickly.

There are a couple of ways around this:

  1. Within Wireshark's capture options, make sure "Update list of packets in real time" is disabled and that "Use multiple files" is enabled.
  2. Instead of using Wireshark use dumpcap. Dumpcap is much more efficient and it's what actually captures packets when you click the "capture" button in Wireshark.

BTW, you might want to save capture files using "Save". Depending on the file format you choose "File→Export" may save packets to a file that Wireshark can't read (hence the word "export").

share|improve this answer
    
Thanks for advice. 'Update list of packets was disabled' about 'Use multiple files' - can you point me where I can change it and what does it do? And for sure many thanks for showing dumpcap. Never heard about it. –  Salvador Dali Nov 22 '12 at 18:52
    
"Use multiple files" is one of the sections in the capture options. You can open the capture options via "Capture→Options" or by clicking on "Capture Options" in the welcome screen. –  Gerald Combs Nov 23 '12 at 1:42
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.