Sniffer® Portable Professional User's Guide - NetScout

“Failed to start capture” Messages?
Capturing Packets
If you receive a Failed to start capture message when using large
capture buffer sizes (for example, greater than 288 MB), upgrade
Windows XP to Service Pack 3. Windows XP Service Pack 3 includes a fix
for Knowledge Base (KB) issue 894472 that resolves this issue.
Saving the Capture Buffer to a File
You can save the capture buffer contents to a file automatically when the
buffer is full by selecting Save to file on the Buffer tab. Specify the
filename prefix and the number of files to be spooled. For example, if
you specify 5 in the Number of files field and click Wrap file names,
the sixth file overwrites the first file. If you do not select Wrap file
names, capture will stop when the fifth file is full.
Opening Saved Trace Files
Sniffer Portable Professional can open trace files saved in the following
formats:
Ethernet Sniffer format. This includes *.cap and *.caz formats.
LibPcap format. This is an industry standard packet capture
format (*.pcap) used by common tools such as tcpdump. The
maximum trace file size for a LibPcap file is 320 MB.
Opening saved trace files lets you display and analyze data as if it was
captured live at that moment. Sniffer Portable Professional treats the
data loaded from a disk file in the same way as data captured live off the
network.
NOTE: Sniffer Portable Professional does not support WAN/ATM
trace files, either in legacy Sniffer formats or LibPcap format. Only
the trace file formats listed above are supported.
NOTE: Sniffer Portable Professional does not save trace files in
LibPcap format; it can only open these files.
User’s Guide 127