Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Wireshark-users: Re: [Wireshark-users] View Filter -> Capture Filter

From: Ulf Lamping <ulf.lamping@xxxxxx>
Date: Thu, 26 Oct 2006 09:42:08 +0200
Stephen Fisher wrote:
On Thu, Oct 26, 2006 at 04:49:45PM +1000, sallas@xxxxxxxxxx wrote:

Cheers, I had tried using 'tcp port 389' but in needing to do a 24hr capture resulted in a lot of info. Even when splitting the data amongst multiple files resulted in 10Mb x 260 files. Opening this many files would be too much. I'm not sure of what the maximum file size WireShark can handle in opening, may give 150Mb a go instead of 10Mb multiple file sizes.

This page gives some tips on improving performance when using large capture files:

  http://wiki.wireshark.org/Performance

The size of capture file supported is only limited by the amount of RAM you have and CPU speed to process all of the packets. I don't think there is an official upper limit
See: http://wiki.wireshark.org/KnownBugs/OutOfMemory

Regards, ULFL