Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am using WireShark to keep an eye on the traffic on two 10G ports, in real time. The problem is that there is so much traffic coming through the two ports that WireShark crashes within a minute.

Is there a way for WireShark to only buffer a small number of packets (say the 10 000 most recent), and discard anything previously captured?

share|improve this question
up vote 2 down vote accepted

You can use rotating log files to obtain something similar.

Using wireshark to keep a "live" view is/was not recommended anyway: i'd rather use tcpdump writing on rotating/"sized" log files ( see tcpdump log options ) and wireshark -r to look ad the results.

share|improve this answer
Can I have rotating log files with wireshark? – Randomblue Aug 6 '13 at 12:55
yep! Somewhere in 'Capture options'. I can't screenshot it right now. – user1293137 Aug 6 '13 at 15:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .