I'm using version 1.4.6 running on a windows XP machine with all the latest updates. I'm running a capture on a spanned network port. I've left the capture running for 4 hours and it saves ok (File>save as) But when I come to do a longer test it crashes, this has been the case for a 72 hour capture and a 24 hour capture. Should this be possible? This has happened on two different machines, both have 100GB+ drives in them so there should be plenty of storage. asked 13 Jun '11, 02:01  scate retagged 14 Jun '11, 19:02  helloworld |
2 Answers:
The answer is: Use dumpcap for long running captures. answered 13 Jun '11, 06:07  Jaap ♦ |
The reason your Wireshark is crashing for long-running captures is likely because it's running out of memory (known issue). One of the workarounds is to use dumpcap as Jaap suggests. answered 13 Jun '11, 12:10  bstn edited 13 Jun '11, 12:13 |
Is that "crashes when doing File -> Save As" or "crashes while it's running the capture before I get a chance to save the file with File -> Save As"? If it's the latter, then it could just be running out of memory, as indicated in the answers. If it's the former, that might be another problem, but we'd need more details about the crash to know what it is.