Sake Blok wrote:
A second option is to use more then one capture
files in a ring buffer fashion limiting each file's size to a reasonable
(for your system) length. This could be easily configured in Wiresharks
capture start dialog.
Unfortunately wireshark will not flush state information when starting
to write to a new file. This means that you will still run out-of-memory
in the end.
Hmmm? I was pretty sure Wireshark did free just about everything when
closing the capture file. Or am I mistaken?