Ethereal capture time

**blubomber** · July 24th, 2003, 02:37 PM

I am running ethereal to try and capture some network errors. How long can i safely leave it on, capturing data, before i risk causing other problems? I am thinking mostly in terms of disk space used by the capture file. The computer it is running on is a domain controller that is getting a fare amount of traffic.

**SeanC** · July 24th, 2003, 03:35 PM

You can stop the capture every so often and then start another one with a new file.

At my work we stop and change the file that Ethereal uses every day. There's only 2 to 4 GB free on that PCs drive. We have to move the files off every once and a while.

The interval depends on how much traffic you're capturing. If you're capturing all traffic then you probably wouldn't last a day. If you're only capturing select traffic then you should be able to last a day maybe two.

Sean

**blubomber** · July 25th, 2003, 11:12 AM

You keep Ethereal running all the time? Why is that?

I did run it on my server and i need to cut down on what it captures. After running for an hour, it was around 70MB! Then it takes another few minutes to even display that data. I am new at reading packets so slowly going through thousands of lines, takes alot of time.

FYI, i am trying to capture an RPC error that a program is causing on client PCs accessing an SQL 2000 database. The program is using COM+ and the vendor is pointing the finger at microsoft saying it is a WINS server problem.

**SeanC** · July 25th, 2003, 11:21 AM

We run Ethereal all the time on our production LAN because of business partner says our network is unstable.

We've been proving them wrong for the last few months. Not that they care. We had to purchase a dedicated PC with a CD-R to get the captures off the computer so the drive doesn't fill up.

Sean