Ethereal-dev: Re: [Ethereal-dev] Capture dialog ringbuffer behaviour

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <gharris@xxxxxxxxx>
Date: Sun, 29 Feb 2004 10:23:02 -0800
On Sun, Feb 29, 2004 at 06:52:21PM +0100, Ulf Lamping wrote:
> >In "Multiple files" mode, the only reasonable "Number of files" value
> >would be "infinity" - any other value would imply that it'd write no
> >more than that number of files.
> >  
> >
> That's exactly the intended behaviour. This is the way to get the 
> *first* xy bytes of a long term capture, and just stop after that.
> Otherwise you would like to use the ring buffer, if you want to have the 
> *last* xy bytes.

OK, if it's the intended behavior, how do I type "Infinity" into the
"Number of files" dialog box?

> The *only* difference between multiple and ring buffer is: when it comes 
> to the end of the last capture file,
> a ring buffer will continue capturing from the first file, but the 
> multiple will just stop capturing.

Really?

I thought there was a mode where it kept capturing, producing more and
more files, until you explicitly told it to stop - no automatic stop;
that's how it works in Tethereal:

       -b  If a maximum capture file size was specified, cause
           Tethereal to run in "ring buffer" mode, with the
           specified number of files.  In "ring buffer" mode,
           Tethereal will write to several capture files.  Their
           name is based on the number of the file and on the
           creation date and time.

           When the first capture file fills up, Tethereal will
           switch to writing to the next file, until it fills up
           the last file, at which point it'll discard the data
           in the first file (unless 0 is specified, in which
                              ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
           case, the number of files is unlimited) and start
           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
           writing to that file and so on.

> That's also the reason, that I wanted to have "Use ring buffer" checked 
> by default, as that's the typical thing to have.

The typical thing to have is to capture to more than one file?  That's
not typical for me.