Wireshark-dev: Re: [Wireshark-dev] Where is the "Packet Range" dialog box created ?
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: "Maynard, Chris" <Christopher.Maynard@xxxxxxxxx>
Date: Wed, 6 Jan 2010 10:19:33 -0500
Why not use dumpcap for day-long capturing instead of Wireshark?

You can configure dumpcap to run continuously or for just a single day
then stop, and you can configure dumpcap to capture only a certain
amount of data per file.  When the limit is reached, it will close the
file and open a new one.  That makes the files a little more manageable
to analyze later on.  You can always use mergecap to combine them later
if you want or you can use editcap to further split them if they're
still too big.  You can view any of the files in Wireshark at any time
without having to stop dumpcap. 

See "dumpcap -h" or "man dumpcap" or
http://www.wireshark.org/docs/man-pages/dumpcap.html


- Chris


-----Original Message-----
From: wireshark-dev-bounces@xxxxxxxxxxxxx
[mailto:wireshark-dev-bounces@xxxxxxxxxxxxx] On Behalf Of BARILLY YANN
Sent: Wednesday, January 06, 2010 3:40 AM
To: Developer support list for Wireshark
Subject: Re: [Wireshark-dev] Where is the "Packet Range" dialog box
created ?

[snip]
CONFIDENTIALITY NOTICE: The contents of this email are confidential
and for the exclusive use of the intended recipient. If you receive this
email in error, please delete it from your system immediately and 
notify us either by email, telephone or fax. You should not copy,
forward, or otherwise disclose the content of the email.