Re: [Ethereal-users] Capture Temp file

[Ulf Lamping <ulf.lamping@xxxxxx>]

Andrena Lefdahl wrote:
> I turned Ethereal on to capture packets on an interface. I stopped it 
> after 3 days. I did not specify a file name. I found that if a file 
> name isn’t specified it is saved to a temp file. When I stopped the 
> capture my computer ran out of memory about halfway through loading 
> the data and closed the program. My question is this, is there anyway 
> to open that temp file and retrieve the data from that capture? Where 
> is the temp file located? Is that data capture I needed over those 
> three important days gone?
The file is still located in the temp folder which name you'll find 
under Help/About/Folders.

Ethereal crashes as it's running out of memory. You can split the 
capture file into smaller pieces using editcap 
(http://www.ethereal.com/docs/man-pages/editcap.1.html).

Next time you may try the "multiple files" capture option to split the 
resulting file already while capturing.

Regards, ULFL