Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I am using WireShark to keep an eye on the traffic on two 10G ports, in real time. The problem is that there is so much traffic coming through the two ports that WireShark crashes within a minute.

Is there a way for WireShark to only buffer a small number of packets (say the 10 000 most recent), and discard anything previously captured?

share|improve this question

1 Answer 1

up vote 2 down vote accepted

You can use rotating log files to obtain something similar.

Using wireshark to keep a "live" view is/was not recommended anyway: i'd rather use tcpdump writing on rotating/"sized" log files ( see tcpdump log options ) and wireshark -r to look ad the results.

share|improve this answer
    
Can I have rotating log files with wireshark? –  Randomblue Aug 6 '13 at 12:55
    
yep! Somewhere in 'Capture options'. I can't screenshot it right now. –  user1293137 Aug 6 '13 at 15:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.