[Richard Urwin <RUrwin@xxxxxxxxxxxxx>]

I configured the capture for 2 10K files called "fred."

Ethereal created a file called "fred". When that was full it created a file
called "fred.001". When that was full I saw the file modified date on "fred"
change as Ethereal went back to it, and when it was full I saw the date of
"fred.001" change as it was refilled. This continued for some significant
number of repetitions.

When I stopped the capture the files were renamed "fred_<date><time>".
(Where <time> was slightly different for each file.)

The source code function ringbuf_switch_file increments the suffix number
modulo the number of files. That modulo would be unnecessary if it intended
to end the capture with the final file. It does not trigger any "end of
capture" behavior that I could see.

-- 
Richard Urwin, Software Design Engineer
Schenck Test Automation
Braemar Court, 1311b Melton Road, Syston, UK.
rurwin@xxxxxxxxxxxxx



-----Original Message-----
From: Eckert, Christopher [mailto:CEckert@xxxxxxxxxxxxxx]
Sent: Wednesday, May 22, 2002 2:07 PM
To: 'Richard Urwin'
Subject: RE: [Ethereal-users] frequent question and request for the
develo pers


What does your do? Please understand, I want a wrapping buffer like I have
in Sniffer but have read many times on the list that at the end of the last
ring buffer it simply stops. I will gladly retract my statement and correct
myself if I am wrong.

Do you see it starting over with the first file name? I am not big on
reading source code. What does the source say it should do?

-----Original Message-----
From: Richard Urwin [mailto:RUrwin@xxxxxxxxxxxxx]
Sent: Wednesday, May 22, 2002 5:04 AM
To: ethereal-users@xxxxxxxxxxxx
Subject: RE: [Ethereal-users] frequent question and request for the
develo pers


> In Ethereal's Ring Buffer a number of files are specified with file sizes
> and once the files are full the capture is finished.

This is not what the source code implies, and it is not what my copy of
Ethereal does.

> It could be done by going back to the first buffer after
> the last one was used

This behavior is implied by the source code, and exhibited by my copy of
Ethereal.
I am using 0.9.3 on WinNT 4.0 fully patched.

I have used 2 files of 10kbytes each, if I tried using 10 files of 10M it
would take too long to fill them. Can you try my test on your system and see
what happens? I enclose a screen grab of the capture dialog for comparison.


-- 
Richard Urwin, Software Design Engineer
Schenck Test Automation
Braemar Court, 1311b Melton Road, Syston, UK.
rurwin@xxxxxxxxxxxxx



-----Original Message-----
From: Eckert, Christopher [mailto:CEckert@xxxxxxxxxxxxxx]
Sent: Monday, May 20, 2002 5:39 PM
To: ethereal-users@xxxxxxxxxxxx
Subject: [Ethereal-users] frequent question and request for the
developers


The ring buffer wrap question seems to come up a lot. What it seems people
are asking for is a wrap buffer, one which, once it reaches the end of the
buffer, it starts overwriting the beginning of the same buffer. That is
common in Sniffer and other brands. It is not something Ethereal does as I
understand it. 

In Ethereal's Ring Buffer a number of files are specified with file sizes
and once the files are full the capture is finished. In other programs, lets
use Sniffer as our example, a single buffer is wrapped. You can specify the
size of this single buffer like you can with Ethereal's ring buffers but
there is only one buffer file. when the maximum size of the file is reached
Sniffer starts writing over the beginning of it. Once the end of the file is
reached it again returns to the beginning of the file and so on and so
forth.

Wrap buffers are handy if you need to leave an analyzer capturing until you
have notification that a problem has occurred and then stop it. You simply
adjust the wrap file size to accommodate the amount of time to be still
stored in the buffer once you get notified. 

This is a common means of usage in the real world and would make Ethereal
much more useable. It could be done by going back to the first buffer after
the last one was used or by wrapping in the same file. Either way it would
be easy enough to train the user population. It would also stop the same
question from being asked over and over. Note that that should be taken as
an indicator of the worlds desire for this option.

I have cross posted this to the developers and documentation lists in hopes
of generating some clarification of this in the users guide and as a means
of begging the developers for this option to be looked into.

 

-----Original Message-----
From: pmarkham@xxxxxxxxxx [mailto:pmarkham@xxxxxxxxxx]
Sent: Monday, May 20, 2002 9:41 AM
To: ethereal-users@xxxxxxxxxxxx
Subject: [Ethereal-users] Re: "ring mode" file size


Without fully understanding the intent of your question, I assume you
realize that 10000 kbytes is 10 megs of data per file?

As a consequence of careless reading, I first played with the filesize based
on the premise that the units were bytes. File changes 
do not take place rapidly when the data pipe is only a 56K dialup.... ;-) 

Peter

Karlheinz Mueller wrote:

> Is it possible that these 10 Files will be used as a kind "Ring Buffer".
> If all 10 files are filled up, then Ethereal will start at the first
> file again and overwrite.
 

_______________________________________________
Ethereal-users mailing list
Ethereal-users@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-users

----------------------------------------------------------------------------
--
This e-mail transmission may contain information that is proprietary,
privileged and/or confidential and is intended exclusively for the person(s)
to whom it is addressed. Any use, copying, retention or disclosure by any
person other than the intended recipient or the intended recipient's
designees is strictly prohibited. If you have received this message in
error, please notify the sender immediately by return e-mail and delete all
copies.


============================================================================
==


_______________________________________________
Ethereal-users mailing list
Ethereal-users@xxxxxxxxxxxx
http://www.ethereal.com/mailman/listinfo/ethereal-users

_____________________________________________________________________
This message has been checked for all known viruses by UUNET delivered 
through the MessageLabs Virus Control Centre. For further information visit
http://www.uk.uu.net/products/security/virus/



________________________________________________________________________
This email has been scanned for all viruses by the MessageLabs SkyScan
service. For more information on a proactive anti-virus service working
around the clock, around the globe, visit http://www.messagelabs.com
________________________________________________________________________

----------------------------------------------------------------------------
--
This e-mail transmission may contain information that is proprietary,
privileged and/or confidential and is intended exclusively for the person(s)
to whom it is addressed. Any use, copying, retention or disclosure by any
person other than the intended recipient or the intended recipient's
designees is strictly prohibited. If you have received this message in
error, please notify the sender immediately by return e-mail and delete all
copies.


============================================================================
==


_____________________________________________________________________
This message has been checked for all known viruses by UUNET delivered 
through the MessageLabs Virus Control Centre. For further information visit
http://www.uk.uu.net/products/security/virus/

________________________________________________________________________
This email has been scanned for all viruses by the MessageLabs SkyScan
service. For more information on a proactive anti-virus service working
around the clock, around the globe, visit http://www.messagelabs.com
________________________________________________________________________