...Unless you're trying to capture data rates higher than 100mbps, or from media
other than Ethernet, in which case Sniffer is useless for long-term capture. In
fact, lately I'm looking to use Ethereal specifically as a replacement for
Sniffer for use simply as a capture appliance.
Sometime in the near future (this week, hopefully) I'm going to start playing
with modifying the maxfiles constant and see if/how well Ethereal captures with
more than 10 files defined. Has anyone actually done any testing to see how
well Ethereal handles a larger number of files? I have no idea what my fopen()
limit is in Linux or Windows, so I'm not sure what my theoretical limit is on
the # of simultaneous files opened.
Do you know if there was a reason why the ring buffer was designed to hold all
files open at the same time? Or was it simpler to design that way, and
eventually it was assumed that someone would implement something more robust?
> On Mon, Jan 27, 2003 at 01:23:07PM -0600, Kurt A. Bernard wrote:
> > (I can't use sniffer because it will not let me adjust my output file
> > format or the summary)
>
> Ethereal can read many Sniffer files, so doing the capture with a
> Sniffer and processing the captures with Ethereal might be an
> alternative.
> _______________________________________________
> Ethereal-users mailing list
> Ethereal-users@xxxxxxxxxxxx
> http://www.ethereal.com/mailman/listinfo/ethereal-users