Re: [PLUG] Wireshark ate itself

["Keith W." <oomplah@gmail.com>]

Is there a question or is this a rabble? :)

My assumptions based upon what I see here is that you're trying to
capture too much at once.  

But yes, if you're not telling wireshark to dump it's buffer after X
bytes, it just eats memory (unless you tell it to roll over when full).
If you ran out, and had to kill the process, I'm pretty sure it's gone.

Broad filters on network links with high traffic will own most systems'
resources.  Specific filters  -- during capture -- using wireshark
usually lessens the pain.  I do remember being some controls within the
application where you can limit wireshark's memory utilization behavior

That's been my experience at least.  

Btw, First time posting on this list - Hello List.

--Keith
On Tue, 2009-06-16 at 14:21 -0400, jeff wrote:
> It ate all the memory and run the cpu to 100%.  I finally managed to 
> nice it, when the system complained that there was no more memory and 
> closed Wireshark.
> 
> I'm guessing the capture is gone from that session, correct?
> 
> This is one of those days where in order to do something simple, thirty 
> three other things have to be done first.  And so on for the next simple 
> task.
> 
> $&#&@@#)$%
> 
> ___________________________________________________________________________
> Philadelphia Linux Users Group         --        http://www.phillylinux.org
> Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
> General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug

___________________________________________________________________________
Philadelphia Linux Users Group         --        http://www.phillylinux.org
Announcements - http://lists.phillylinux.org/mailman/listinfo/plug-announce
General Discussion  --   http://lists.phillylinux.org/mailman/listinfo/plug