As far as I know there is no way for dumpcap to pass packets in memory to the Wireshark process, especially since Wireshark keeps rereading packets on display all the time. If you think about it for a moment you’ll probaby realize that if Wireshark is reading packets that dumpcap captured that there is no way around writing them to disk first. I already wrote an article about using dumpcap to avoid memory problems here.Īlright, we have established that Wireshark does not capture packets itself, it’s using dumpcap. That way Wireshark knows when to re-read the file to display the current list of packets. As soon as the capture is running, dumpcap informs Wireshark whenever there are new packets written to the file. In fact, Wireshark creates a dumpcap process and passes it the parameters for the capture. with Process Explorer on Windows, you can see what happens if you start a capture: Instead, it calls dumpcap.exe whenever you start a capture, and reads the file written by dumpcap. If we look at Wireshark as a tool package it is able to capture packets, but if you look at the Wireshark executable, it isn’t.

A lot of readers will now think “wait a minute, I know for sure that I have captured tons of packets with Wireshark!”, and I have to admit that it’s not that far from the truth. One of the concepts of capturing with Wireshark is that Wireshark does not capture packets. One of the common questions is “how can I avoid writing packets to disk, and just capture them in memory?”. Sometimes it is important to know how Wireshark captures packets, and when it is writing them to disk.

Wireshark windows 2003