Wireshark mailing list archives
The file "/tmp/etherXXXXnFYKCC" could not be opened: Uncompression error: buffer error.
From: Oguz Yilmaz <oguzyilmazlist () gmail com>
Date: Sun, 7 Mar 2010 19:35:31 +0200
Hi, I am planning to use tshark for continuous operations. Tshark is set to directly sniff the ethernet. So it runs dumpcap. In the /tmp/, there are lots of files named etherXX****. When the tmp was full, tshark has exit with the message: tshark: The file "/tmp/etherXXXXyH7Hcs" could not be opened: Uncompression error: buffer error. tshark: Child capture process died: Broken pipe The command was tshark -i br0 -f "(port 110)" -R 'pop.request.parameter contains "user"' >> /var/log/logger/pop3 and the processes created were: 28894 pts/4 S+ 0:00 tshark -i br0 -f (port 110) or (vlan and port 110) -R pop.request.parameter contains "user" 28895 pts/4 S+ 0:00 /usr/sbin/dumpcap -i br0 -Z none -f (port 110) or (vlan and port 110) OS is Centos EL 5. My problem is: - Is there any way to dump without creating a temporary file. I do not want to tackle with filling up some partition. What do you suggest for filling the /tmp up. Killing tshark, cleaning /tmp and restarting tshark? - While tshark process prolonged, shall the process need more memory? If so, I should stop and start in some intervals. Oguz. ___________________________________________________________________________ Sent via: Wireshark-users mailing list <wireshark-users () wireshark org> Archives: http://www.wireshark.org/lists/wireshark-users Unsubscribe: https://wireshark.org/mailman/options/wireshark-users mailto:wireshark-users-request () wireshark org?subject=unsubscribe
Current thread:
- The file "/tmp/etherXXXXnFYKCC" could not be opened: Uncompression error: buffer error. Oguz Yilmaz (Mar 07)