Wireshark-users: Re: [Wireshark-users] Capturing stops although there is still network traffic
From: Guy Harris <guy@xxxxxxxxxxxx>
Date: Wed, 18 Mar 2009 11:03:44 -0700

On Mar 18, 2009, at 4:12 AM, Michael Naugk wrote:

I did some tests with ps and realized that the state of process dumpcap
switches between S and R. Might that be a hint?

I.e., once packets stop showing up, dumpcap is in state R?

If so, there might be some loop it's stuck in, so that it's spinning rather than reading captured packets.