ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
April 17th, 2024 | 14:30-16:00 SGT (UTC+8) | Online

Wireshark-users: Re: [Wireshark-users] Sniffing1GigE interfaces without laptop crashing

From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Sun, 20 Nov 2011 13:10:13 -0800
On Nov 20, 2011, at 9:56 AM, Richard Bejtlich wrote:

> There's no need to use a protocol analyzer like Wireshark, Tshark, or
> even Tcpdump to just do packet capture.  You introduce more trouble
> than it's worth.

The main codepath of "tcpdump -w" is pretty lightweight - probably about as lightweight as dumpcap's.