Ask Your Question

Wireshark GUI freezes for a minute on capture start

asked 2022-01-23 20:26:17 +0000

rossboulet gravatar image

Running Windows 10, 21H2, Wireshark 3.6.1, Npcap 1.60, NO USBpcap.

When I start a capture, everything looks good for a few seconds. I see packets being displayed. After a few seconds, the display freezes. Then, approximately 60 seconds after I started the capture, the display frees up and seems to catch up. Anyone else seeing this behavior?

edit retag flag offensive close merge delete


Some type of name resolution timeout perhaps?

Bob Jones gravatar imageBob Jones ( 2022-01-24 10:47:48 +0000 )edit

I noticed a similar behaviour running under windows 7 and NCAP 1.6. I tried reinstalling a few times and winding back to previous restore points to no avail. Reverting to Wireshare 3.4.11 was the only option for me.

alex314 gravatar imagealex314 ( 2022-01-26 01:36:08 +0000 )edit

2 Answers

Sort by ยป oldest newest most voted

answered 2022-01-27 23:08:13 +0000

rossboulet gravatar image

Thanks for the suggestions. It was not a DNS issue, but it got me started digging into the settings. I turned off all the MAC and name resolution options and was still having the issue. Finally, I created a new profile and the issue went away. By exporting my old and new profiles and comparing them, I found the problem. A while back I was experimenting with decrypting some HTTPS traffic and has set the Windows environment variable for SSLKEYLOGFILE and added a Wireshark option to the TLS protocol for (Pre)-Master-Secret log file. My SSL log file had grown to over 800MB. So when I would start a capture, as soon as it caught a TLS packet, the GUI would freeze while the log file was accessed. I was wondering why there was a variable length of time before it froze, but after this discovery, I found it was always freezing on the first TLS packet.

edit flag offensive delete link more


Chuckc gravatar imageChuckc ( 2022-01-28 03:29:32 +0000 )edit

answered 2022-01-25 20:15:09 +0000

mrEEde gravatar image

This could possibly be a DNS resolution attempt slowing down the the machine.
Please retry by unchecking the 'Use an external network name resolver' under the Name resolution preferences . Regards Matthias

edit flag offensive delete link more

Your Answer

Please start posting anonymously - your entry will be published after you log in or create a new account.

Add Answer

Question Tools


Asked: 2022-01-23 20:26:17 +0000

Seen: 2,245 times

Last updated: Jan 27 '22