Revision history [back]

It is not recommended to run Wireshark / tshark for long run, due to the amount of memory required to build all the relationship between packets. See this link and this one for details. Better perform the capture first and analyze it afterwards (after splitting the capture if required).

Note that the amount of packets you can apture before getting a crash will depend on plenty of factors: the protocols involved, your protocols configuration, the WIresahrk version used, etc...

It is not recommended to run Wireshark / tshark for long run, due to the amount of memory required to build all the relationship between packets. See this link and this one for details. Better perform the capture first and analyze it afterwards (after splitting the capture if required).

Note that the amount of packets you can apture capture before getting a crash will depend on plenty of factors: the protocols involved, your protocols configuration, the WIresahrk version used, etc...