https://bugs.wireshark.org/bugzilla/show_bug.cgi?id=4864
--- Comment #4 from Bill Meier <wmeier@xxxxxxxxxxx> 2010-06-12 18:56:17 EDT ---
(In reply to comment #3)
> I don't know about the real time display - where is that setting?
>
> On edit\preferences\capture - everything is checked except "capture packets in
> pcap-ng format"
>
> Wireshark opened the file fine. Do you still want me to attach it? If so it
> will have to be private.
Not needed since there apparently was no crash.
> Here is the output from the command line:
>
> c:\Program Files\Wireshark>dumpcap -i 2 -a duration:15 -w foo.pcap
> File: foo.pcap
> Packets: 439987 Packets dropped: 388749
>
An awful lot of dropped packets...
I think almost 50 % (I'm pretty sure the first "Packets" means "Packets
captured/saved to file").
I don't know why Wireshark is crashing (altho I could believe that maybe it's
running out of memory).
In any case, with that many dropped packets the capture might not be too
useful.
One possibility: Restrict the rate/amount of packets captured by using a
capture filter with dumpcap (eg: only capture packets to/from a particular
host, etc).
See: http://wiki.wireshark.org/CaptureFilters
The following may also be of interest:
http://wiki.wireshark.org/KnownBugs/OutOfMemory
--
Configure bugmail: https://bugs.wireshark.org/bugzilla/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.