How do I set the capture to auto save periodically so WireShark doesn't crash? asked 02 Apr '11, 13:29  bkready |
One Answer:
Open up the capture options dialog (second button on the toolbar, or "Capture" -> "Options" in the main menu) and set a file name. Then check "Use multiple files" and select a good file size for "Next file every ... megabytes". You could also go for "Next file every ... minutes" but I only recommend doing that when the amount of traffic is very consistent, otherwise the megabyte limits make more sense. Finally, to stop your disk from running out of space you might consider to use the "Ring buffer with..." feature. The way it works is that as soon as Wireshark has written the number of files you set it will replace the oldest and continue to capture, overwriting files as needed. answered 02 Apr '11, 13:52  Jasper ♦♦ |
But keep in mind that Wireshark is a very memory intensive application, so even with using multiple files and ring buffering as Jasper mentions, it might still crash if it runs out of memory. The recommended solution in that case, especially when performing long-term capturing, is to use dumpcap instead, which also supports writing to multiple files and ring buffers, but whose memory usage is much lower.