[Guy Harris <guy@xxxxxxxxxxxx>]

On Sat, Nov 29, 2003 at 02:32:08PM -0000, Keith French wrote:
> When ethereal is capturing packets are they held in a capture buffer
> or written to a temporary file?

Written to a temporary file.

> What is the purpose of the ring buffer & "rotate capture file"?

To

	1) let users limit the total number of packets captured and see
	   only the most recently arrived packets

or

	2) let a capture be split into multiple files as it's being done
	   to limit the sizes of individual capture files (that's done
	   by not limiting the *number* of capture files).

> Does this save a trace direct to multiple files
> each of a filename of a size specified by the ring buffer setting?

Yes (approximately - we don't guarantee that the files will be *exactly*
that size).