Wireshark · Wireshark-users: Re: [Wireshark-users] tshark crash with capture ring buffer (-b) and decoding packets (-S)

[Will Cladek <will.cladek@xxxxxxxxxxxx>]

> One suggestion would be to avoid doing a full decode and print ("-S") but rather limit the decode output significantly ("tshark -T fields -ehttp.referer").  That might help.  You could also mess with process priorities and the like but I doubt that would buy you much.

It appears that the -S option is required when writing to a ring buffer for it to print out anything -- the -T/-e options won't work alone.  When used together, it seems to add a little time before it crashes, but not much.

So I guess the problem really comes down to the fact that tshark can't decode at line rate.  Using a capture filter to just look at port 80 is probably good enough for my uses, and it seems the data is sufficiently lower that tshark can keep up the decoding.  So thanks for the info, I'll just have to keep that all in mind.

-Will