Wireshark-users: Re: [Wireshark-users] Default save location, memory limitation, preserve vlan tags

From: Jaap Keuter <jaap.keuter@xxxxxxxxx>
Date: Sat, 06 Dec 2008 19:17:33 +0100

Hi,

1&2 are easy: Use dumpcap i.s.o. wireshark: it just captures data from the network and stores it at the location you indicate. No dissection is done, so no RAM is consumed for that.

3, I'm not sure. Looks like you're running Win32, so YMMV. Have a try with Ubuntu or something, that usually works.

Thanx,
Jaap


junk mail wrote:

I have 3 questions

1) How do I change the default save directory from c:\docu~\a\temp ? My c drive is very low on space and I need to change this save location to my d drive where I have more space.

2) How can I get wireshark to not stop capturing after RAM runs out ? Thing is the captures I am running are generating about 1gb of capture file size for every 2 minutes of capture and then after about 2 minutes it tells me wireshark is out of memory and is about to close but the capture is automatically saved at that location. Ideally I would like to be able to capture for about 20 minutes at a time

3) How can I preserve vlan tags when capturing ? I already downloaded the intel driver, as well as edited my registry as per intel's intructions but it still strips the vlan tags.

I am running wireshark 1.0.4 latest release downloaded this week on a compaq 8510p laptop with 2gb ram.

Thanks people

Santino