Wireshark-users: Re: [Wireshark-users] Sniffing1GigE interfaces without laptop crashing
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Sun, 20 Nov 2011 13:10:13 -0800
On Nov 20, 2011, at 9:56 AM, Richard Bejtlich wrote:

> There's no need to use a protocol analyzer like Wireshark, Tshark, or
> even Tcpdump to just do packet capture.  You introduce more trouble
> than it's worth.

The main codepath of "tcpdump -w" is pretty lightweight - probably about as lightweight as dumpcap's.