Wireshark · Ethereal-users: Re: [Ethereal-users] /var : file system Full

[Guy Harris <gharris@xxxxxxxxx>]

On Sat, Nov 02, 2002 at 12:53:31PM +0530, Pankaj Thapa wrote:
>    Not all the packets could be written to the file to which the
>    capture was being saved( ("null") because there is no
>    space left on the file system on which that file resides.
> Is it the max buffer limit.

No, it's the file system size limit - as the message says, "not all the
packets could be written to the file ... because there's no space left
on the file system on which that file resides".  There is no "max buffer
limit" in Ethereal.

You're capturing more traffic than fits on the file system with
"/var/tmp" on it - i.e., "/var".

By default, Ethereal captures to a temporary file; typically, it's in
"/var/tmp" on UNIX systems.

Either:

	1) capture less traffic;

	2) make "/var" bigger;

	3) find a file system with more space on it, and with a
	   directory on it into which you can write a capture file, and
	   put the pathname of that file in the "File:" field in the
	   "Capture Options" dialog box when you start the capture.