This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi. I got problem with “closing file waiting…."

0

When I make multiple file as 100mb.. It appeared on currently capturing session. It seems to be temporary message... but it's not finished until I close Wireshark.... please help me.. It happened to stable version of Wireshark 1.8.4

asked 27 Jan '13, 18:10

SSH's gravatar image

SSH
11112
accept rate: 0%

edited 28 Jan '13, 11:21

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142


2 Answers:

0

Try using dumpcap instead. It's a command line tool that you can use to capture packets to disk, and you'll find it in the Wireshark installation directory. Wireshark uses dumpcap itself to capture files, so you can do the same.

Use dumpcap -D to get a list of capture interfaces first. Then you can run dumpcap with parameter -i and the number of the interface to capture on it.

A typical dumpcap call could look like this:

dumpcap -i 1 -w capture.pcapng -b filesize:100000

to capture on interface 1, write to file "capture.pcapng" and create a new file each 100MB. In fact, if you use -b like that, each filename will have date and time and a running number added to it to become unique.

answered 27 Jan '13, 18:55

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

edited 28 Jan '13, 11:24

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142

0

This looks like bug 3046 to me. The work-around is to follow the advice that Jasper provided.

answered 28 Jan '13, 11:22

cmaynard's gravatar image

cmaynard ♦♦
9.4k1038142
accept rate: 20%