This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

When leaving wireshark running a trace it crashes and in event viewer I get the error.

Faulting application name: Wireshark.exe, version: 2.0.3.0, time stamp:0x571a5d95
Faulting module name: libwireshark.dll, version: 2.0.3.0, time stamp 0x571a5ca5
Exception code: 0x0000005
Fault offset: 0x0000000000012527
Faulting process id:0x1308
Faulting application start time: x01d1bfc97d4ed270
Faulting application pat: C:\Program Files\Wireshark\Wireshark.exe
Faulting module path: C:\Program Files\Wireshark\libwireshark.dll
Report Id: *cbdb5a6-2c1c-11e6-8253-bb8e6fa7e1c0

asked 08 Jun '16, 01:51

MattG's gravatar image

MattG
6335
accept rate: 0%

edited 08 Jun '16, 02:18

grahamb's gravatar image

grahamb ♦
19.8k330206

What were you doing with Wireshark when the crash occurred? If you've been running it for some time with reasonable amounts of traffic it's likely that Wireshark run out of memory, see this Wiki page for more info.

(08 Jun '16, 02:19) grahamb ♦

The wireshark is being used to monitor traffic constantly out of a firewall

(08 Jun '16, 02:37) MattG

From your additional comment I'm pretty certain that it is an out of memory situation.

What is the purpose of running wireshark in this manner, as there may be better tools for you to use, e.g. dumpcap?

(08 Jun '16, 02:45) grahamb ♦
The wireshark is being used to monitor traffic constantly out of a firewall

That suggests that it would be prudent to use dumpcap to get your captures, and use Wireshark to selectively analyse them.

(08 Jun '16, 02:48) Jaap ♦

Its for a customer they wanted wireshark running constantly , I will try just using the dumpcap to capture the traffic, thanks

(08 Jun '16, 05:49) MattG

Check the ring buffer options allowing to write the output into a series of smaller files, as it is much more convenient to handle these files later (analysis & eventual archiving).

(08 Jun '16, 05:53) sindy
showing 5 of 6 show 1 more comments
Be the first one to answer this question!
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×1,620
×193
×84

question asked: 08 Jun '16, 01:51

question was seen: 1,577 times

last updated: 08 Jun '16, 05:53

p​o​w​e​r​e​d by O​S​Q​A