Hello,
I am using th latest stable wireshark version to capture data on a windows server. I selected the "Stop capture automatically after" option and assigned 24 hours. However, the value automatically changes to 60 seconds for some reason. Can anyone tell me if this is a known bug or if I should change the option?
Thank you in advance.
I have not opened a new issue but have fix in merge request for Multiple Files preference "Create new file automatically...after" [time] working incorrectly
5131 - Qt: capture with file intervals bug; autostop duration reset
Capturing doesn't stop after 60 seconds, but if you stop the capture and look at the time duration, it's reset to 60 seconds. However, if you stop/start the current capture or more simply just restart the current capture, then the 24 hour stop duration will still be used, as long as you don't view the capture options again. Once you do that, then the 60 second capture duration will be applied, so if you had previously set the stop duration to 24 hours and hadn't noticed the change in the stop duration, your captures would unexpectedly stop much sooner than expected. This behavior is not intuitive and breaks user expectations; it should be filed as a Wireshark bug report.
You are correct. The capture does not stop just after 60 seconds, but it stops randomly. However, I expected the capture to stop after 24 hours since the beginning of the capture. I googled it and could not find any bug reports regarding this symptom though.
I wasn't willing to wait 24 hours so I'll take your word for it that it stops randomly. All I know is that it didn't stop at 60 seconds as long as you didn't view the capture options where it could be seen that the stop time had been changed from 24 hours to 60 seconds, in which case it would stop after 60 seconds.
And there likely won't be a bug report unless you file one, which is why I suggested that you do that.
Asked: 2020-03-23 01:11:49 +0000
Seen: 711 times
Last updated: Nov 18 '21
Does it actually stop after 60 seconds, to is it just the user interface that shows this?
The option under the capture filter automatically changes from 24 hours to 60 seconds