While capturing, the underlying libpcap capturing engine will grab the
packets from the network card and keep the packet data in a (relatively)
small kernel buffer. This data is read by Wireshark and saved into
the capture file(s) the user specified.
Different modes of operation are available when saving this packet data to
the capture file(s).
Working with large files (several 100 MB's) can be quite slow. If you plan
to do a long term capture or capturing from a high traffic network, think
about using one of the "Multiple files" options. This will spread the
captured packets over several smaller files which can be much more
pleasant to work with.
Using Multiple files may cut context related information.
Wireshark keeps context information of the loaded packet data, so it can
report context related problems (like a stream error) and keeps information
about context related protocols (e.g. where data is exchanged at the
establishing phase and only referred to in later packets).
As it keeps this information only for the loaded file, using one of
the multiple file modes may cut these contexts. If the establishing phase
is saved in one file and the things you would like to see is in another,
you might not see some of the valuable context related information.
A temporary file will be created and used (this is the default). After the
capturing is stopped, this file can be saved later under a user specified
Single named file
A single capture file will be used. If you want to place the new capture
file to a specific folder, choose this mode.
Multiple files, continuous
Like the "Single named file" mode, but a new file is created and used,
after reaching one of the multiple file switch conditions (one of the
"Next file every ..." values).
Multiple files, ring buffer
Much like "Multiple files continuous", reaching one of the multiple files
switch conditions (one of the "Next file every ..." values) will switch
to the next file. This will be a newly created file if value of "Ring
buffer with n files" is not reached, otherwise it will replace the oldest
of the formerly used files (thus forming a "ring").
This mode will limit the maximum disk usage, even for an unlimited amount of
capture input data, keeping the latest captured data.