On Oct 29, 2003, at 2:16 PM, Ian Schorr wrote:
What you can't do currently, however, is instruct Ethereal to stop
after it writes a certain number of files or bytes. You can tell it
to stop after a certain number of frames, and after a certain number
of seconds, but not tell it to record up to a certain number of bytes
if saving to multiple files.
The problem is that the duration and filesize stop conditions are
overloaded - if you're not using the ring buffer, they're stop
conditions, but if you are, the maximum file size is a "switch file"
condition.
Perhaps "-a" should *only* specify a stop condition, and "-b" should
take an argument like
n,test:value
to specify when to switch buffers, e.g.
-a filesize:10000 -b 0,filesize:1000
would say "switch files every 1,000,000 bytes, stop capturing when you
reach 10,000,000 bytes". If "n" is omitted, all capture files are
kept; if "test:value" isn't specified but "n" is, that'd be an error.
In the GUI, it might look like
[] Switch capture files every [ ] kilobyte(s) captured
[] Switch capture files every [ ] second(s)
[] Keep the last [ ] capture files
where turning on the third of those is equivalent to specifying the "n"
argument to "-b", turning on the first of those is equivalent to
specifying "filesize:" to "-b", and turning on the second of those is
equivalent to specifying "duration:" to "-b". Again, you'd have to
choose one of the "Switch capture files" options for "Keep the last [
] capture files" - I'd gray "Keep the last [ ] capture files" out
if neither of the "Switch capture files" options are specified.
We might want to add a "packets:N" condition as well, for "-a" and
"-b", and have "Switch capture files every [ ] packet(s)
captured" as an option, for completeness.