 | 1 | initial version |
No, that statement is not correct. PCAP files can have any size, but Wireshark has some limits loading them. This doesn't depend only on file size, but also on what's in the file. E.g. if there is a lot of protocols (like TCP) where Wireshark keeps a lot of state/expert/symptom/association information, you'll run out of memory much sooner. So you may be able to load a 2 GByte file in one situation, while you can't in another, depending on what was captured.
In general you should think of Wireshark as a microscope - it can show the greatest detail possible, but it's not really made for huge chunks of stuff moved under the lens.
