Wireshark · Wireshark-users: Re: [Wireshark-users] Continuous/circular in-memory tracing?

[Stephen Fisher <stephentfisher@xxxxxxxxx>]

On Fri, Dec 21, 2007 at 10:10:45PM -0700, Stephen Fisher wrote:

> Maybe in the future.  I thought this had been requested before, but I
> don't see it in the wish list (wiki.wireshark.org/WishList) or in the
> bug database (http://bugs.wireshark.org) at quick glance.

This is the closest to your need that I can find in the Wish List:

Under
http://wiki.wireshark.org/WishList#head-22284e2d12a336464422602a5f6046b6d90bdb62

---
Provide a "Circular" capture file. It would be nice to be able to
specify that I want a xMeg capture file and that I want the contents to
wrap when full rather than stopping or requiring that you move to
another file in a ring buffer. (This is currently not possible with the
libpcap file format we use, and probably with none of the other file
formats we support. Implementing this would require to define a new file
format, and do a lot of effort in Wireshark itself to support this. -
Ulf Lamping) (This could be done with an in-memory circular buffer; I
think that's how a number of other capture programs work. The
disadvantage of that is, of course, that you're limited by the size of
the buffer. - Guy Harris)
---

Steve