WebGUI: Diagnostics > Packet Capture will try to display any size of pcap file.
The diag_packet_capture.php p[age will try to display any size of pcap when the capture is stopped regardless of how large it is.
This can result it either long load times and an unmanageably large page or at larger sizes it exhausts the available php memory for a single page:
Crash report begins. Anonymous machine information: amd64 11.2-RELEASE-p4 FreeBSD 11.2-RELEASE-p4 #2 b00c407ba5d(RELENG_2_4_4): Mon Nov 26 11:41:48 EST 2018 firstname.lastname@example.org:/build/ce-crossbuild-244/obj/amd64/ZfGpH5cd/build/ce-crossbuild-244/pfSense/tmp/FreeBSD-src/sys/pfSense Crash report details: PHP Errors: [27-Dec-2018 19:35:43 America/Toronto] PHP Fatal error: Allowed memory size of 536870912 bytes exhausted (tried to allocate 532692992 bytes) in /usr/local/www/diag_packet_capture.php on line 541 [27-Dec-2018 19:35:43 America/Toronto] PHP Fatal error: Allowed memory size of 536870912 bytes exhausted (tried to allocate 532676888 bytes) in Unknown on line 0 No FreeBSD crash data found.
However it is still possible to download the capture when this happens.
It would be nice to see it show just a message explaining why it's not showing the capture. Or maybe a new detail level of 'None' so you have to deliberately choose 'Normal' to attempt to display it. That could apply to any capture over, for example, 5000 packets.
Updated by Vladimir Lind almost 3 years ago
tested on 2.4.5-DEVELOPMENT (arm)
built on Fri Jan 25 05:46:46 EST 2019
Invoked a lot of traffic while running pcap with unlimited packet count. Got message when stopped pcap in 30 min:
Packet capture file is too large to display in the GUI.
Download the file, or view it in the console or ssh shell.
pcap file 1.8G was available for downloading
Updated by Anonymous almost 3 years ago
On 2.4.5.a.20190201.0810, tested with an iperf3 traffic stream running over WAN with a simultaneous packet capture on the same interface for about 5 minutes at about 700-800 Mbps. When the packet capture was stopped,
Packet capture file is too large to display in the GUI. Download the file, or view it in the console or ssh shell.
appeared in the Packets Captured box. Clicked Download Capture button and the resulting multi-gigabyte capture file downloaded without issue.