JP Vossen on 16 Jun 2009 12:13:52 -0700

[Date Prev] [Date Next] [Thread Prev] [Thread Next] [Date Index] [Thread Index]

Re: [PLUG] Wireshark ate itself

> Date: Tue, 16 Jun 2009 14:21:09 -0400
> From: jeff <>
> It ate all the memory and run the cpu to 100%.  I finally managed to 
> nice it, when the system complained that there was no more memory and 
> closed Wireshark.
> I'm guessing the capture is gone from that session, correct?

I'm pretty sure.

Maybe use tcpdump instead of Wireshark to avoid the GUI tax?  They both 
use the same BPF ( 
language (see "expression" in the man page), which is (or at least was) 
*different* than the WireShark display filter language!

You might need to experiment with tcpdump settings to get them right. 
'-s 1600' and -w come to mind, see also -c, -C, -l, -n, and others.  It 
has an excellent and comprehensive man page.

> This is one of those days where in order to do something simple, thirty 
> three other things have to be done first.  And so on for the next simple 
> task.

I hate it when that happens.

JP Vossen, CISSP            |:::======|
My Account, My Opinions     |=========|
"Microsoft Tax" = the additional hardware & yearly fees for the add-on
software required to protect Windows from its own poorly designed and
implemented self, while the overhead incidentally flattens Moore's Law.
Philadelphia Linux Users Group         --
Announcements -
General Discussion  --