Wireshark-users: Re: [Wireshark-users] Tshark Filter to create new smaller PCAP
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Stephen Fisher <steve@xxxxxxxxxxxxxxxxxx>
Date: Thu, 1 Dec 2011 10:33:34 -0700
On Tue, Nov 29, 2011 at 01:56:13PM -0800, George Vandelet wrote:

> I have a PCAP file that is over 100M.  I wish to open it but my GUI 
> version of Wireshark 32.0.0_ofc14 but it crashes each time I try to 
> open it. 

I'm not sure what version of Wireshark that corresponds to, but if it's 
not 1.6 or at least 1.4, you may need to upgrade to get better 
performance and that *might* let it work without crashing.  That is 
assuming it is crashing due to being out of memory and not a bug.  See 
http://wiki.wireshark.org/KnownBugs/OutOfMemory