I am running 1.4.1 on Win 7 x64 laptop with 4G ram. Packet capture as follows: Limit each packet to 150 bytes Use multiple files Ring buffer - 20 files Buffer size - 300 megabytes Update list of packets in real time - unchecked Automatic scrolling in live capture - unchecked Enable MAC name resolution - checked Enable network name resolution - unchecked Enable transport name resolution - checked About 4 or 5 files in, I see several instances of the badly formed window with "Closing file please wait". If I close the multiple windows, wireshark starts capturing packets again. This problem seems very similiar to this old bug http://ipv4.wireshark.org/lists/wireshark-bugs/200903/msg00223.html Anyone have any ideas? asked 20 Oct '10, 12:09  ramasan edited 04 Aug '11, 15:28  cmaynard ♦♦ |
One Answer:
Same problem here. The worst part is that I'm capturing with 10 wireshark instances 10 remote daemons and after a couple of hours when I close the capture it opens 150 "closing file" instances and crashes my windows. answered 21 Oct '10, 10:42  mreg |
Next file every ??? I rolled every 100K, just as an example. Any capture filter? I did not specify one. The system I am currently running on only has 2GB of RAM so I was not able to use a 300MB Buffer size. Instead Wireshark set it to the default of 1MB. Running with 1.6.1 with these settings, I did not experience this problem. Can you try with version 1.6.1?