Wireshark-users: Re: [Wireshark-users] Memory vs Wireshark
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: "Saulpaugh, Chris" <Chris.Saulpaugh@xxxxxxxxxxxxx>
Date: Wed, 11 Aug 2010 07:31:32 -0700

This is an inherent limitation of some of the Wireshark versions and Windows systems. I recommend you use multiple smaller capture files and stitch them together afterwards. I normally limit myself to 128 MB capture files and accept the fact that my traces will create a series of files.

 

Some of the forum experts can offer additional guidance on this.

 

From: wireshark-users-bounces@xxxxxxxxxxxxx [mailto:wireshark-users-bounces@xxxxxxxxxxxxx] On Behalf Of Emilio Honorio de Melo
Sent: Tuesday, August 10, 2010 9:20 PM
To: wireshark-users@xxxxxxxxxxxxx
Subject: Re: [Wireshark-users] Memory vs Wireshark

 

Sorry, I forgot to tell you the Processor model: Q6600 Intel.

 

Thanks,

Emilio

2010/8/11 Emilio Honorio de Melo <ehm@xxxxxxxxxxx>

Dear all,

 

Please, I need your help.

 

I've been using the wireshark to capture some data from a 3G network. I've been face some problems regarding to RAM memory.

Here it is the configuration set:

 

- 8GB RAM

- Windows server 2008 64bit

- HD West Digital Black 7200 RPM / 64MB Buffer / 2TB

- Attansic L1 Gigabit Ethernet 10/100/1000 Base-T Adapter

 

I just can captures files of 200MB ~ 300MB large. More than this, I got out of memory crash.

 

And when I process with Wireshark 32bit version (1.2.9), I can run with no problem untill the Windows task manager point 3GB physical use of. If I run the wireshark 64bit version (1.2.10), I got only 2GB...

 

Please, how can I supplant this issues? Or these are wireshark RAM limitations?

 

By the way, the capture throughput is about 250Mbps.

 

Best Regards,

Emilio