Wireshark-users: Re: [Wireshark-users] Wireshark sniffer stop by itself

From: Bill Meier <wmeier@xxxxxxxxxxx>
Date: Wed, 01 Sep 2010 11:17:41 -0400

Bill Meier wrote:

גוטליב טובים אסף wrote:

Dear Support Members,

I have been facing a problem with the Wireshark sniffer for several
times in the past month and I would like to ask your advise:

We are capturing data on one of are switches. We left the sniffer
working for several days and when we came to check out the files we
found out that it stop by itself few days earlier. The space hasn't
run out on the local drive, the sniffer didn't stop working
completely but only the capture stop. Im pretty shure we have
config the capture properly. I have attached a screen shot of the
capture configuration window & the app release.

The problem has reoccurred several times in the past and I don’t
really know what can cause the sniffer stop capturing the data.

Please see: http://wiki.wireshark.org/KnownBugs/OutOfMemory

Wireshark accumulates "state" during a capture and thus will
eventually run out of memory during an extended capture.

It would be better to use Dumpcap If you want to do an extended
capture.

Dumpcap just captures the data and writes it to a file. (Dumpcap is
the program used by Wireshark to capture data).

Addendum:

Re:

>> ...., the sniffer didn't stop working
>> completely but only the capture stop.

Do you mean that the Wireshark GUI was still running and responding ?

If so: then I don't know what happened.

I would still try using Dumpcap by itself to see if the problem still occurs.