I can certainly second Guy on this point I have in production had a linux
box which basically captured all traffic to and from a developement server.
As soon as the file got to 1.2gb a new file was started and when we began
running low on disk space the files were then copied off to cd. This setup
rans continously 365 days a year so infinite ringbuffer has been an absolute
blessing here as it means very low maintenance on the capture side. These
files are analysed by a team of developers who write and load new
client/server based code onto the server on a daily basis and need to know
day by day how their code is affecting the network and vice versa.
hope this helps
Evan
>On Sun, Feb 29, 2004 at 08:24:37PM +0100, Ulf Lamping wrote:
>> Do you really have a use case for this? (see below)
>
>I don't, but I assume Laurent Deniel, who put that feature in, did, or
>knew people who did, and I think I've seen other people asking how they
>can do that - there might be stuff in the mail archives about this.
>
>I think their use case is that they want to run a capture for a very
>long time, but not to have a single giant capture file - they want the
>file carved into smaller pieces, to cut the amount of data in a single
>file and thus to make it less painful to, for example, process the file
>in Ethereal.