[Guy Harris <gharris@xxxxxxxxx>]

On Mon, Jun 18, 2001 at 02:36:41PM +0200, Matthias wrote:
>    2. Dump captured packets to ringbuffer, i.e. only the most recently
> captured
>       packets are available (includes support for multiple dump files).

What defines "most recently captured" here?  The most recent N packets? 
The most recent M bytes worth of packet data captured?

Note also that "Update list of packets in real time" would presumably
require that "unavailable" packets be removed from the CList that
displays packets - as well as requiring that the linked list of packets
have packets removed from it.

In addition, if doing so removes some fragments that had previously been
reasembled, this could cause problems for the IP/IPv6/CLNP reassembly
code.

It might well be that the combination of a ring-buffer capture and
"Update list of packets in real time" is either impossible to implement
correctly, impossible to implement sensibly, or impossible to implement
without adding a lot of complexity to Ethereal and several of its
dissectors, and shouldn't be supported (disappointing thought that might
be to the user, but sometimes features users really really really really
really want end up doing violence to the code and end up getting in the
way of features that other users really really really really really
want).