9. Wireshark
Wireshark is a software that captures network packets and can store them on disk. In order to avoid filling the
partitions on the hard drive and thus crashing the system, here is a best practice about managing the capture
files disk usage.
Even when saving the capture to a file, wireshark keeps the packets in memory for the display. This leads to
a huge memory usage on long run captures. In order to avoid this, use tshark instead of wireshark.
9.1 Know the available space
In a console, the available space per partition can be known by running “df –h”. Look at the available column
to know the available space per partition.
Use the appropriate partition to store the capture files when defining the name and path of the capture file.
9.2 Do not update packet list in real time
In order not to increase the memory usage of wireshark during the capture. Uncheck the options “Update list
of packets in real time” and “Automatic scrolling in live capture”, in Edit => Preferences => Capture.
The memory will not be used until the end of the capture. However, when the capture is stopped, wireshark
loads the packets in the user interface which will use a lot of memory and maybe enough to crash the
system.
9.3 Stop after a defined capture size
It is possible to define a max capture filesize.
In the capture option window, in the stop capture section, select “… after” and define the limit value. The limit
can be a number of packets, a size or a time. For disk space issues, choose a size value.
To Next Page
Loading...
Need help?
General
