This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Wireshark crashing when running a trace

0

When leaving wireshark running a trace it crashes and in event viewer I get the error.

Faulting application name: Wireshark.exe, version: 2.0.3.0, time stamp:0x571a5d95
Faulting module name: libwireshark.dll, version: 2.0.3.0, time stamp 0x571a5ca5
Exception code: 0x0000005
Fault offset: 0x0000000000012527
Faulting process id:0x1308
Faulting application start time: x01d1bfc97d4ed270
Faulting application pat: C:\Program Files\Wireshark\Wireshark.exe
Faulting module path: C:\Program Files\Wireshark\libwireshark.dll
Report Id: *cbdb5a6-2c1c-11e6-8253-bb8e6fa7e1c0

asked 08 Jun '16, 01:51

MattG's gravatar image

MattG
6●3●3●5
accept rate: 0%

edited 08 Jun '16, 02:18

grahamb's gravatar image

grahamb ♦
19.8k●3●30●206

What were you doing with Wireshark when the crash occurred? If you've been running it for some time with reasonable amounts of traffic it's likely that Wireshark run out of memory, see this Wiki page for more info.

(08 Jun '16, 02:19) grahamb ♦

The wireshark is being used to monitor traffic constantly out of a firewall

(08 Jun '16, 02:37) MattG

From your additional comment I'm pretty certain that it is an out of memory situation.

What is the purpose of running wireshark in this manner, as there may be better tools for you to use, e.g. dumpcap?

(08 Jun '16, 02:45) grahamb ♦
The wireshark is being used to monitor traffic constantly out of a firewall

That suggests that it would be prudent to use dumpcap to get your captures, and use Wireshark to selectively analyse them.

(08 Jun '16, 02:48) Jaap ♦

Its for a customer they wanted wireshark running constantly , I will try just using the dumpcap to capture the traffic, thanks

(08 Jun '16, 05:49) MattG

Check the ring buffer options allowing to write the output into a series of smaller files, as it is much more convenient to handle these files later (analysis & eventual archiving).

(08 Jun '16, 05:53) sindy
showing 5 of 6 show 1 more comments