This is our old Q&A Site. Please post any new questions and answers at

I have met some problem with wireshark. my situation is i have a good IBM server,the server's configuration is below:

CPU: 4 core, xeon 7500, 2.0GHz
disk: 10000RPM  600GBytes
RAM: 32GBytes
Ethernet ports:  1 Gigabit
the version of wireshark: 1.6 64bits
the OS : Windows 2008 R2

the flow of my data is 250Mbps more or less, but when i collect the date for one hour, the size of the date collected is just only 95GBytes. So there are about 14Gbytes drop.

So, who can tell me why , and give me a solution, thanks a lot.

asked 08 Mar '12, 19:16

anew_flyfree's gravatar image

accept rate: 0%

edited 08 Mar '12, 23:56

SYN-bit's gravatar image

SYN-bit ♦♦

First thing to do is try the dumpcap utility: its job is to simply capture packets and do it quickly. It doesn't have all the overhead of the GUI.

Increasing the capture buffer size (with dumpcap's "-B" command-line argument) may also help.

If that doesn't help (enough), which I suppose may be the case if you're really talking 250 Mbps, you may need to look into some commercial solutions. Riverbed sponsors Wireshark and also makes products which complement it: for example dealing with high-speed and long-term capturing.

permanent link

answered 09 Mar '12, 06:50

JeffMorriss's gravatar image

JeffMorriss ♦
accept rate: 27%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 08 Mar '12, 19:16

question was seen: 2,490 times

last updated: 09 Mar '12, 06:50

p​o​w​e​r​e​d by O​S​Q​A