This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Capture Multiple Files

0

Hi guys,

I have a problem with wireshark creating multiple files. I try to capture the network trafic for several days on a system with the following options: -use multiple files -next file every 2 megabytes -ring buffer with 9999 files

unfortunaly this doesn't work! There are two different things happening. 1. the system opens several wiresharkwindows which all tell me "closing files" but nothing happens. 2. the wireshark application crashes with an Application error Event ID 1000. The system had already created 800 capture files saved at this time, but then it stops with this application error....

wireshark version is 1.8.2.44520 and it runs on Windows 2008 Server

Sorry for my bad english, but I'm from Germany and still learning....

I would be happy to hear from you. Any help will be appreciated! Please let me know if further information or data is required!

Thanks & Regards Wolfgang

asked 16 Sep '13, 04:46

Wolfy's gravatar image

Wolfy
11113
accept rate: 0%

edited 16 Sep '13, 04:47

When you experienced the "Closing File" problem, was it the same as what is described in bug 3046? That bug was closed as fixed for releases after 1.6.x, but perhaps it's not truly fixed and should be reopened. If you do reopen it, if you any have more information that might help someone recreate/test/fix it, please provide it.

(16 Sep '13, 07:23) cmaynard ♦♦

2 Answers:

0

answered 16 Sep '13, 04:51

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

Hi Jasper,

thanks a lot for your quick answer. I'm going to try this "dumpcap" thing and let you know if it won't work, too ;-)

Regards Wolfgang

(16 Sep '13, 05:22) Wolfy

As Jasper said, dumpcap is certainly the way to go for this type of capturing.

But it's also interesting that you're hitting this problem. It sounds like bug 3046 which is supposed to be fixed in the 1.8.x versions.

(16 Sep '13, 08:28) JeffMorriss ♦

Hi cmaynard, Hi Jeff,

thanks a lot for your answers!

I think you are right. It sounds like the ""Closing File!" Dialog Hangs - Bug" and I'm already running wireshark version 1.8.2.44520 on Windows 2008 Server, so I'm not sure if bug 3046 is realy fixed... I tried several different settings and found that it is working if I limit the size of the file to 1MB. With a file size of 2 MB this "closing file" Error happens after a while.

Unfortunately I have no experience how to "reopen a bug" or what data or information might be relevant to do this....

Again, thanks a lot Wolfgang

(18 Sep '13, 01:37) Wolfy

0

See also this question and note the answer from @cmaynard.

answered 16 Sep '13, 05:18

grahamb's gravatar image

grahamb ♦
19.8k330206
accept rate: 22%