Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-bugs: [Wireshark-bugs] [Bug 2131] Allow in-memory circular capturing

Date: Thu, 4 Mar 2010 15:42:44 -0800 (PST)
https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=2131

Bill Meier <wmeier@xxxxxxxxxxx> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |wmeier@xxxxxxxxxxx

--- Comment #2 from Bill Meier <wmeier@xxxxxxxxxxx> 2010-03-04 15:42:43 PST ---
(In reply to comment #1)

> The issue you'll face is that wireshark's memory management (memory usage keeps
> growing until it crashes) makes it a bad long-running sniffer especially if
> you're dealing with high packet rates.

Following up on this:  

Dumpcap is used by Wireshark to actually do the capture; It just captures &
saves data. It does no analysis and keeps no history and so memory usage will
not increase.

So: using Dumpcap with "ring buffer with n files" on a ram disk probably
provides
pretty close to the functionality requested by the OP.

-- 
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.