Hello Andrea
Packet capturing in general is a mechanism that does use up some CPU and memory resources of the device. Obviously the better the CPU and the more memory you have, the less chance you have of crashing the router.
The use of a linear or circular buffer do not have a very big impact on whether or not the device will crash. A linear buffer will probably be safer, since it automatically stops once the buffer is reached. A circular buffer will continue to capture packets forever until you configure it to stop.
However, the most important configuration parameters that have an impact on CPU and memory usage such as:
- Decoding and displaying packets
- using a display and decode mode of "detailed:
- the activation of a wireshark capture point as this creates a fixed rate policer in the hardware that can flood the CPU
- capturing an excessive number of attachment points at the same time
Also, the CPU usage during capture depends on how many packets match the specified conditions and on the intended actions for the matched packets (store, decode and display, or both).
You can find more information about what impacts a device’s resource usage at the following Cisco documentation:
I hope this has been helpful!
Laz