Revision history  [back]

First of all, if you kill wireshark from the task manager, the running capture file still exists in the folder pointed to by Temp in the Folders tab of About Wireshark. So you will be able to retrieve the captured data.

When a capture can't be stopped, it is usually because of the traffic load, not sure if this is already reported as a bug, but I think it would qualify as one, you can file a bug report by opening an 'Issue' on https://gitlab.com/wireshark

Possible workarounds:

• Make sure you use a capture filter to not capture traffic that you are not interested in
• Add a stop condition to the capture so it will stop automatically
• Disable update packet list while capturing in the capture options
• Use dumpcap instead of Wireshark to do the capturing (my preferred option)