User Guide

Capturing Live Network Data

Use multiple files Instead of using a single file, Wireshark will automatically switch

to a new one, if a specific trigger condition is reached.

Use pcap-ng format This checkbox allows you to specify that Wireshark saves the

captured packets in pcap-ng format. This next generation capture

file format is currently in development. If more than one interface

is chosen for capturing, this checkbox is set by default. See http://

wiki.wireshark.org/Development/PcapNg for more details on pcap-

ng.

Next file every n megabyte(s) Multiple files only: Switch to the next file after the given number

of byte(s)/kilobyte(s)/megabyte(s)/gigabyte(s) have been captured.

Next file every n minute(s) Multiple files only: Switch to the next file after the given number

of second(s)/minutes(s)/hours(s)/days(s) have elapsed.

Ring buffer with n files Multiple files only: Form a ring buffer of the capture files, with the

given number of files.

Stop capture after n file(s) Multiple files only: Stop capturing after switching to the next file

the given number of times.

4.5.3. Stop Capture... frame

... after n packet(s) Stop capturing after the given number of packets have been

captured.

... after n megabytes(s) Stop capturing after the given number of byte(s)/kilobyte(s)/

megabyte(s)/gigabyte(s) have been captured. This option is greyed

out, if "Use multiple files" is selected.

... after n minute(s) Stop capturing after the given number of second(s)/minutes(s)/

hours(s)/days(s) have elapsed.

4.5.4. Display Options frame

Update list of packets in real time This option allows you to specify that Wireshark should update the

packet list pane in real time. If you do not specify this, Wireshark

does not display any packets until you stop the capture. When you

check this, Wireshark captures in a separate process and feeds the

captures to the display process.

Automatic scrolling in live

capture

This option allows you to specify that Wireshark should scroll the

packet list pane as new packets come in, so you are always looking

at the last packet. If you do not specify this, Wireshark simply adds

new packets onto the end of the list, but does not scroll the packet

list pane. This option is greyed out if "Update list of packets in real

time" is disabled.

Hide capture info dialog If this option is checked, the capture info dialog described in

Section 4.13, “While a Capture is running ...” will be hidden.