Everyone expects that Wireshark does start from scratch each time a new file is created, but well, both Wireshark and tshark don’t. Unfortunately, even though Wireshark will now create a new file each time 100MB were captured it will still crash after a while, which is kinda confusing. You could easily configure it in the capture options like this to capture into files of 100MB each: Typical file sizes are 64MB, 100MB, 128MB, 256MB.
This one looks promising: instead of capturing all the packets into one single large file we could configure Wireshark/tshark to write a new file after a certain amount of data has been captured. “Around” #2: capture packets into multiple files
#Wireshark capture code#
You can use the developer builds to run tshark with the code change.
#Wireshark capture update#
Update 4: this will become a valid workaround in combination with “Around #2” as soon as Wireshark 2.0 is released (right now we’re still running 1.12 stable), since Evan changed the way tshark works. And that reason is: the out of memory crash doesn’t have much to do with the GUI. There is a simple reason why running tshark instead of Wireshark doesn’t help much, even though tshark is probably less resource consuming than Wireshark simply because it is a console application that doesn’t carry the additional weight of a graphical GUI. So, let’s take a closer look at the situation, and first I want to walk you through the usual workarounds everybody tries that actually do not work (so I guess they’re just “arounds” :-)) “Around” #1: run tshark instead of Wireshark I guess I’m not the only one of the guys answering question more frequently at that site that often thinks that “I really need to create a answer template for this one. Sometimes someone tries tshark instead of Wireshark but still encounters the same problem. The other thing that may happen is that Wireshark seems to freeze while capturing, which can be caused by very high amounts of packets being received during the capture. This is how a typical crash looks like (your mileage may vary): It is one of the most common question on the Wireshark Q&A site: “I have xyz gigabyte of memory, but still Wireshark crashes when I try to capture data”, with xyz being a more or less impressive (or even ridiculous) amount of memory.
0 kommentar(er)
