Why not use dumpcap for day-long capturing instead of Wireshark? You can configure dumpcap to run continuously or for just a single day then stop, and you can configure dumpcap to capture only a certain amount of data per file. When the limit is reached, it will close the file and open a new one. That makes the files a little more manageable to analyze later on. You can always use mergecap to combine them later if you want or you can use editcap to further split them if they're still too big. You can view any of the files in Wireshark at any time without having to stop dumpcap.
See "dumpcap -h" or "man dumpcap" or http://www.wireshark.org/docs/man-pages/dumpcap.html - Chris -----Original Message----- From: [email protected] [mailto:[email protected]] On Behalf Of BARILLY YANN Sent: Wednesday, January 06, 2010 3:40 AM To: Developer support list for Wireshark Subject: Re: [Wireshark-dev] Where is the "Packet Range" dialog box created ? [snip] CONFIDENTIALITY NOTICE: The contents of this email are confidential and for the exclusive use of the intended recipient. If you receive this email in error, please delete it from your system immediately and notify us either by email, telephone or fax. You should not copy, forward, or otherwise disclose the content of the email. ___________________________________________________________________________ Sent via: Wireshark-dev mailing list <[email protected]> Archives: http://www.wireshark.org/lists/wireshark-dev Unsubscribe: https://wireshark.org/mailman/options/wireshark-dev mailto:[email protected]?subject=unsubscribe
