Wireshark-users: Re: [Wireshark-users] Reliability?
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Thu, 18 Feb 2010 16:14:33 -0800
On Feb 18, 2010, at 4:06 PM, Bob Carlson wrote:

> We have been trying to do a long running capture and we cannot keep Wireshark up and running. WS is up to date. We are monitoring 1 port and writing out 100MB files. Each file is filled in a 2-4 hours. WS will not stay up forever. It dies every so often. We are trying a larger buffer size.
>  
> Are there any known issues?

Other than "dissecting packets consumes memory, so if you use Wireshark or TShark to do a long running capture, you will eventually run out of memory and Wireshark/TShark will fail"?

The way to avoid that issue is not to use Wireshark or TShark to do long-running captures, and to use dumpcap instead.