This is our old Q&A Site. Please post any new questions and answers at

I am using Wireshark version 1.8, newly installed. Wireshark is crashing when trying to open a 400MB file. It gets to roughly 47%, then dies.

I get a Microsoft Visual C++ Runtime library error.

asked 07 Aug '12, 10:37

drumhrd's gravatar image

accept rate: 0%

edited 07 Aug '12, 14:02

multipleinterfaces's gravatar image


Use the command line tool editcap to split the large file into smaller files. Editcap was installed when you installed Wireshark. Even if you could open the 400 MB file, you would find it difficult to work with because of its size. In particular, applying and clearing display filters would take a very long time.

You can find the editcap syntax by clicking on Help > Manual Pages > Editcap from within Wireshark.

permanent link

answered 07 Aug '12, 10:58

Jim%20Aragon's gravatar image

Jim Aragon
accept rate: 24%

Wireshark is /probably/ dying because it's running out of memory. See OutOfMemory.

Note that it's not uncommon for me to analyze 400 Mb capture files but I have a 64-bit OS (and 64-bit Wireshark) and lots of RAM. (Note here too that there have been reports that 64-bit Wireshark on 64-bit Windows is NOT able to actually take advantage of lots of RAM; I think there's a bug report about that.)

(08 Aug '12, 06:45) JeffMorriss ♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 07 Aug '12, 10:37

question was seen: 7,380 times

last updated: 08 Aug '12, 07:25

p​o​w​e​r​e​d by O​S​Q​A