If you want to live capture a long session, maybe over the course of a couple of hours. You will want to perform this so that you can capture the traffic to multiple files, based on size or duration of time, this makes the results much easier for analysts to work with, transferring, etc.

I like to create a dedicated directory for the capture session. I usually place them in Capture or ProjectNameCapture directorv. Once the capture session is complete, you can select the interesting PCAP files out of the session and delete or archive the others.

Launch Wireshark application. Open Capture options, select the Output tab.

Select the checkbox Create a new file automatically… to be able to set your preferences for when to create the next file. You have the options of packets, size, duration, and multiple of time. There is also the option to use a ring buffer, which will remove the oldest file after the given number of files has been written.

If you have knowledge of when the session should stop you can also automatically set the capture to stop after packets, files, or specific multiple of time.

Click the Start button to start a capture session, writing the capture to the specified directory as multiple files.

Wait for or repeat the issue and stop the capture. Collect the files from the capture directory you created earlier.

Happy packet capturing!