This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I've been having reliability issues with multiple Wireshark versions on 2008 server. Initially the GUI would crash mid-capture. So I then started to use tshark, but this suffered the following issue:

When capturing to file the packet counter displayed within cmd prompt would freeze. Pressing any key on the keyboard (i.e. STDIN) would get the counter incrementing again. I assumed it was just the counter freezing, however looking at the capture file there's a complete gap in capture whilst the screen is frozen.

Note: The same issue occurs with dumpcap.

Any help massively appreciated

asked 04 Sep '13, 01:10

Timchampion's gravatar image

Timchampion
6334
accept rate: 0%


Wireshark and tshark crashes are inevitable when doing captures that run for a long time or just capture a lot of packets. Both keep information about TCP connections in memory (mostly for reassembly), which will lead to a crash sooner or later, even when storing packets into multiple files.

Dumpcap should work, because it just writes packets to disk, without any overhead. Are you sure that dumpcap has the exact same issue as tshark?

permanent link

answered 04 Sep '13, 01:40

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×832
×89
×7

question asked: 04 Sep '13, 01:10

question was seen: 1,776 times

last updated: 04 Sep '13, 01:40

p​o​w​e​r​e​d by O​S​Q​A