["S. Faizi" <salfaizi@xxxxxxx>]

Hi all:

 

I have ethereal capturing data on a very active link. I setup a ring buffer consisting of 4 files each of 16MB. I would like to stop capturing data when I detect a problem on the console of the system whose interface I am capturing data from so that I stop logging.

 

I would like to automate this using expect. If expect detects a certain output pattern on console, then I would like to have the script log into the machine running ethereal and have it stop logging data. I could issue a kill -9 to the ethereal process and stop logging, but then I will lose data in ethereal buffer that has not been written to the disk.

 

Does ethereal trap any signals for starting and stopping capture? Is there a better way of doing this than the approach I am planning?

 

Thanks!

 

Sal