[Jack Jackson <jack@xxxxxxxxxxxxxxx>]

At 02:24 am 09/08/2002, Guy Harris wrote:
> > 2) How long (how big) can I reasonably let Ethereal run in Capture
> > mode if I don't specify a max value? Can it write a file in progress
>
> That's all it does - Ethereal has no in-memory buffer that it fills up
> with captured data (other than the buffer used by the "standard I/O"
> library it uses to write to files, but when that fills, the I/O library
> just writes stuff out and empties the buffer).
While that is true, Ethereal will attempt to display the packets, either 
during the capture if "Update list of packets in real time" is checked or 
if  it is not checked at the end of the capture.  At least on Win2K if 
there are a large number of packets Ethereal will either take so long to 
finish displaying the packets that it has to be aborted, or it will run out 
of memory.