ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Wireshark-bugs: [Wireshark-bugs] [Bug 9816] Crash when temporary capture file fills up the file

Date: Fri, 28 Feb 2014 16:31:27 +0000

Comment # 6 on bug 9816 from
(In reply to comment #5)
> > the other way around would use more space, not less.
> I don't understand why not saving user data would use more space.

We have to store either the raw packet or the parsed data. A raw packet is
usually ~1500 bytes. The complete parsed data for a single packet is (in my
experiments) usually around 25000 bytes. We only store the raw packet, since it
is much smaller.

> > There is already an option to capture in a ring-buffer (cycle).
> Thank you. I missed that. But I suggested about disk (directory) free space
> monitoring. In some scenarios it's more useful.

It's very difficult to do consistently in a cross-platform way, and it is easy
enough to see how much space you have and set the options appropriately.

> Also I meant about default
> temp file not about "Capture->Options". It says "Ring buffer requested, but
> capture isn't being saved to a permanent file."

You must enter a filename for it to work. Ring-buffer does not work with
temporary files (I don't know why, but there's a comment in the code claiming
it doesn't).


You are receiving this mail because:
  • You are watching all bug changes.