Wireshark · Wireshark-users: Re: [Wireshark-users] Sniffing1GigE interfaces without laptop crashing

[Guy Harris <guy@xxxxxxxxxxxx>]

On Nov 20, 2011, at 2:15 PM, Kevin Cullimore wrote:

> in either case, no reason NOT to use dumpcap/tcpdump/windump for these purposes . . .

As long as it's "capture and then look at it later" (which is probably the case if you're capturing full-on GigE), yes.

However, if it's a kernel panic, the issue may have nothing to do with whether you're watching the traffic while you're capturing it, and may pop up even with a relatively simple userland network->file code path, or with a faster CPU, or....