["Roy Kidder" <RoyKidder@xxxxxxxxx>]

Interesting. Based not on the code, but solely on the man page:

duration
  Stop writing to a capture file after value seconds have
  elapsed.

...I would think that it would watch the system clock and stop regardless
of the number of packets captured (or not captured as the case may be).

In my scenario, I'm trying to watch for someone doing something they're
not supposed to do on my network (during a fixed duration of time). As a
result, there may or may not be packets present.

Maybe what I'm looking for should be a proposed feature for future
releases... something like '-a timeout:xx' for example where the packet
capture terminates after xx seconds regardless of other conditions.

Thanks,
Roy

Tim Everitt said:
> The -a duration is checked for expiry _after_ each packet is received. If
> no
> packets are ever received past the capture filters the timer expiry will
> never be checked.
>
> I consider this a feature not a fault.