https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=7833
--- Comment #13 from Chris Maynard <christopher.maynard@xxxxxxxxx> 2012-10-15 18:06:36 PDT ---
(In reply to comment #12)
> The Hard drive on the pc isn't large enough to host the data coming through.
That either sounds like you're capturing a lot more than 100-200MB of data, or
your hard drive is very small indeed.
> So I have an external. If I run dumpcap and it's only saving to a temp
> directory, it'll crash due to tying up resources there. Is there a way to
> redirect the capture to the external drive?
Bill explained in comment 6 that you can use "dumpcap -w <filename>" to specify
the file to write to, which can be located on any drive you like; however, if
you're capturing *all* traffic, then depending on how you're accessing that
drive (samba, nfs, ...), you could end up capturing the traffic that you're
sending to the file, which of course is self-replicating. If that's the case,
then you will need to ensure that you exclude that traffic using an appropriate
capture filter.
By the way, if you're writing a lot of packets, you might want to consider
using dumpcap's ringbuffer options to help limit the size of each file, as well
as the maximum number of files written so as not to completely exhaust your
disk space.
> Does it also open in Wireshark as if it was a normal live capture?
Wireshark can open any capture file written by dumpcap.
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are watching all bug changes.
