Ethereal-users: Re: [Ethereal-users] Capture Temp file
Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.
Andrena Lefdahl wrote:
I turned Ethereal on to capture packets on an interface. I stopped it
after 3 days. I did not specify a file name. I found that if a file
name isn’t specified it is saved to a temp file. When I stopped the
capture my computer ran out of memory about halfway through loading
the data and closed the program. My question is this, is there anyway
to open that temp file and retrieve the data from that capture? Where
is the temp file located? Is that data capture I needed over those
three important days gone?
The file is still located in the temp folder which name you'll find
under Help/About/Folders.
Ethereal crashes as it's running out of memory. You can split the
capture file into smaller pieces using editcap
(http://www.ethereal.com/docs/man-pages/editcap.1.html).
Next time you may try the "multiple files" capture option to split the
resulting file already while capturing.
Regards, ULFL
