Wireshark-users: Re: [Wireshark-users] Continuous/circular in-memory tracing?
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Jay Levitt <lists-wireshark@xxxxxxxxxxxxx>
Date: Sat, 22 Dec 2007 08:07:14 -0500
On 12/22/2007 4:01 AM, Sake Blok wrote:

On Fri, Dec 21, 2007 at 10:10:45PM -0700, Stephen Fisher wrote:

On Fri, Dec 21, 2007 at 10:00:54PM -0500, Jay Levitt wrote:


As far as I can tell from searching the forum, there's no good way to
keep Wireshark up and running and capturing to an in-memory circular
buffer,

Correct.


But... Wireshark comes with a utility called 'dumpcap'. Although
this utility does write to disk instead of memory, it does not
keep session-information. This means that it doesn't hog your
memory while capturing for long periods of time. I have a system
running with dumpcap for a few weeks now, it has captured almost
2 billion packets by now in a ring buffer of 1024 files of 16MB.
(and the laptop on which it is running is still happy :-)  ).
Could you expand on "does not keep session information"? I assumed that the only difference between doing it with dumpcap and doing it within Wireshark was the lack of a loaded GUI. 



The syntax I used is:

dumpcap -i <interface> -s 1518 -w <file.cap> -b filesize:16384 -b files:1024

How's that for catching an intermittent problem :-)


That's pretty darn intermittent! :)


Jay