This is a static archive of our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Tshark.exe is closing abnormally after some hours of execution.

0

Hi, i need to take USB trace for 7 days but after some hours of trace capture, the tshark exe is closing without any exception. please any one help me to solve this issue.

Syntax: tshark.exe -i 3 -b filesize:10000 -b files:3 -w <usbtracefilename>.

Thanks in Advance!!!!

asked 31 May '17, 07:33

Pramod's gravatar image

Pramod
11●4●4●8
accept rate: 0%

One Answer:

1

Probably an out of memory error. Use dumpcap.exe for long-term captures.

Edit

Unfortunately dumpcap is (currently) unable to use USBpcap as a capture source, so this won't work.

answered 31 May '17, 07:38

grahamb's gravatar image

grahamb ♦
19.8k●3●30●206
accept rate: 22%

edited 31 May '17, 10:12

Hi, Thanks for the replay, can u please provide syntax for using dumpcap.exe

Thanks in Advance!!

(31 May '17, 07:42) Pramod

It should be the same. The man page is here, or use dumpcap -?.

(31 May '17, 07:51) grahamb ♦

yes i tried Dumpcap.exe but it is not displaying USB interfaces.

Please refer below screen shot alt text

Thanks in Advance!!!

(31 May '17, 08:40) Pramod

I wasn't aware that dumpcap doesn't support USBpcap. Wireshark\tshark use the extcap mechanism for alternate capture sources such as USBpcap, unfortunately dumpcap doesn't support that.

I can't offer any solution in this case apart from debugging the issue in tshark, even then the problem might be in usbpcap.

You could also raise an issue on the USBPcap github site asking for support for ring buffers.

(31 May '17, 10:09) grahamb ♦

You can try capturing the USB traffic with USBPcapCMD.exe as explained here: http://desowin.org/usbpcap/tour.html Then load the pcap in Wireshark (or if it is too big split it in chunks with editcap first).

(31 May '17, 10:34) Pascal Quantin