This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I'm trying to catch an intermitant problem we think may be a broadcast storm. My first task is finding the log file. Where does wireshark put it?

My next task is to automatically delete before it gets to big and then start the log again. Is there anything premade for something like that?

Network of 80 machines, random network lockup anywhere from 1-30 sec for all machines at the same time. I was planning to keep 10 minutes chunks of wireshark logs, and when a lock up occurs have some one in the lab grab the log and note the time so we can have a look see. Does that sound like a good plan?

Are there scripts already for this?

Is there anywhere I can share mine if I make one?

Thank you, rd42

asked 22 Nov '10, 07:18

rd42's gravatar image

rd42
1111
accept rate: 0%


All machines lock up for 1-30 seconds? Sounds like a Spanning Tree / loop problem to me.

The plan is good, but I guess "log file" is what is usually called a "trace file", which is a file containing captured network data. The idea is good to capture chunks, and to do that you should open the capture options dialog, second button on the left of the toolbar. Set capture to file, specify a good capture size (8-16MB) and let it write either in a large ring buffer or write continuously. Then wait for the problem and look at the according file.

I bet you'll see tons of duplicate packets created by a layer 2 loop, which means you have to enable/redesign your spanning tree.

permanent link

answered 22 Nov '10, 07:25

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

You might also want to look at using the Wireshark dumpcap program with ring buffers.

Dumpcap just captures and saves; It doesn't do any analysis (which requires saving state as the capture progresses).

When you encounter a problem you can then stop dumpcap and then use Wireshark to look at the capture(s).

See: http://www.wireshark.org/docs/man-pages/dumpcap.html

(22 Nov '10, 07:44) Bill Meier ♦♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×28
×9

question asked: 22 Nov '10, 07:18

question was seen: 21,647 times

last updated: 22 Nov '10, 07:44

p​o​w​e​r​e​d by O​S​Q​A