This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

I'm using version 1.4.6 running on a windows XP machine with all the latest updates.

I'm running a capture on a spanned network port. I've left the capture running for 4 hours and it saves ok (File>save as)

But when I come to do a longer test it crashes, this has been the case for a 72 hour capture and a 24 hour capture.

Should this be possible? This has happened on two different machines, both have 100GB+ drives in them so there should be plenty of storage.

asked 13 Jun '11, 02:01

scate's gravatar image

scate
1111
accept rate: 0%

retagged 14 Jun '11, 19:02

helloworld's gravatar image

helloworld
3.1k42041

Is that "crashes when doing File -> Save As" or "crashes while it's running the capture before I get a chance to save the file with File -> Save As"? If it's the latter, then it could just be running out of memory, as indicated in the answers. If it's the former, that might be another problem, but we'd need more details about the crash to know what it is.

(16 Jun '11, 11:53) Guy Harris ♦♦

The answer is: Use dumpcap for long running captures.

permanent link

answered 13 Jun '11, 06:07

Jaap's gravatar image

Jaap ♦
11.7k16101
accept rate: 14%

The reason your Wireshark is crashing for long-running captures is likely because it's running out of memory (known issue). One of the workarounds is to use dumpcap as Jaap suggests.

permanent link

answered 13 Jun '11, 12:10

bstn's gravatar image

bstn
3751415
accept rate: 14%

edited 13 Jun '11, 12:13

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×254
×84

question asked: 13 Jun '11, 02:01

question was seen: 3,081 times

last updated: 16 Jun '11, 11:53

p​o​w​e​r​e​d by O​S​Q​A