Wireshark · Ethereal-users: Re: [Ethereal-users] Problems with Ethereal

[Guy Harris <gharris@xxxxxxxxx>]

mail.panino@xxxxxxxx wrote:
> Thanks for your answer.
> Is there only this method?

You're doing this on Windows, so there's no way to have some other 
program tell Ethereal to cleanly stop capturing, so, yes, you have to 
tell it to capture for some amount of time and then stop by using the 
"-a" flag.

If you just shut your machine down while Ethereal is running, Ethereal 
will *NOT* cleanly stop capturing - it will probably just exit in the 
middle of writing out the capture file.  If you then attempt to read in 
the resulting capture file, you might get a "The capture file appears to 
have been cut short in the middle of a packet." error.