Capture

Under the Capture category, you can choose a Default interface:

Now, as you've noticed before, I have a number of interfaces on my system. You can select your favorite interface, or your most commonly used interface on your capturing system, if you use one so very often.

You can also turn on and off the pcapng format, but I would highly recommend that you leave it enabled since that is now the new standard format; but if you have a requirement to capture only in the old pcap format for some reason, for some legacy software or something like that, you can certainly do so.

To improve performance in Wireshark, you may want to turn off these two options: Update list of packets in real time and Automatic scrolling in live capture. You've noticed what we've done so far in the captures. The moment you click on Capture, it starts scrolling through in that packet list, showing you everything that's coming in at that moment. Now, that is useful for small captures and quick ones, but if you have a system that's receiving a lot of data (maybe it's a SPAN port on a heavily used trunk, or the system is old and it potentially could drop packets because it doesn't have the processing power to do that) you may want to turn this off to preserve your performance in Wireshark.

..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
3.16.15.149