Wireshark · Wireshark-users: Re: [Wireshark-users] View Filter -> Capture Filter

[Ulf Lamping <ulf.lamping@xxxxxx>]

Stephen Fisher wrote:
> On Thu, Oct 26, 2006 at 04:49:45PM +1000, sallas@xxxxxxxxxx wrote:
>
>   
> > Cheers, I had tried using 'tcp port 389' but in needing to do a 24hr 
> > capture resulted in a lot of info. Even when splitting the data 
> > amongst multiple files resulted in 10Mb x 260 files. Opening this many 
> > files would be too much. I'm not sure of what the maximum file size 
> > WireShark can handle in opening, may give 150Mb a go instead of 10Mb 
> > multiple file sizes.
> >     
>
> This page gives some tips on improving performance when using large 
> capture files:
>
>   http://wiki.wireshark.org/Performance
>
> The size of capture file supported is only limited by the amount of RAM 
> you have and CPU speed to process all of the packets.  I don't think 
> there is an official upper limit
See: http://wiki.wireshark.org/KnownBugs/OutOfMemory

Regards, ULFL