asked 04 Feb '15, 09:56  opus |
One Answer:
What version of wireshark, and is this 32 bit or 64 bit? The Help >> About box will give you all the details. The problem is likely to be out-of-memory. If you have a 64 bit OS, you can try a 64 bit version of Wireshark if you haven't already, else you can use editcap to split the capture into smaller files. There is also the possibility that the issue is a bug in a dissector. You would need to post the capture in a public spot to allow others to check that. answered 04 Feb '15, 10:11  grahamb ♦ |
Thanks for responding. The behavior is occurring in version 1.12.2 (64-bit) running on a 64-bit Windows 7 Machine with 4GB of RAM. I'll try using editcap; thanks for the suggestion.
For what it's worth, there's at least one report of 64-bit Wireshark on Windows acting as if it didn't have as much address space available as it should have if it's truly 64-bit; I'm not sure whether that's the result of not performing the appropriate ritual sacrifices over the MSVC linker to get the program to really truly be 64-bit or not.