问题描述
我的tshark程序在后台运行的时候，使用了SFTP协议下载服务器上的资源。这时候tshark报如下错误：
$ tshark -ni nflog:40 -w capturefile.pcap -b filesize:131072 -b files:120
Running as user "root" and group "root". This Could be dangerous.
Capturing on 'nflog:40'
6654 tshark: Error while capturing packets: Can't receive packet 105:No buffer space available
Please report this to the Wireshark developers.
https://bugs.wireshark.org/
(This is not a crash; please do not report it as such.)
我检查了我的内存使用情况，交换空间很大。
Tasks: 99 total,1 running,98 sleeping,0 stopped,0 zombie
%cpu(s): 34.5 us,4.9 sy,0.0 ni,58.9 id,0.0 wa,0.0 hi,1.7 si,0.0 st
KiB Mem : 2047960 total,662668 free,936364 used,448928 buff/cache
KiB Swap: 4194296 total,4011780 free,182516 used. 903000 avail Mem
我想知道为什么会这样？
解决方法
可以使用 -B 参数修改缓冲区大小，在我的例子中，我将缓冲区大小从默认的 2 MB 增加到 12 MB，使用的命令如下：
tshark -ni nflog:40 -B 12-w capturefile.pcap -b filesize:131072 -b files:120