[Keith Edmunds <keith@xxxxxxxxxxxxxxx>]

I've looked at the documentation, but I don't see an obvious way of
doing this. Suggestions would be welcome.

I am investigating a problem where a large file transfer (using scp/ssh)
fails after anything up to 1Gb has been transferred, although sometimes
it fails much earlier. I want to capture the packets leading up to the
failure for analysis, but if I try to capture every packet for a 1Gb
transfer I'm going to end up with a large capture file. Is there a way
of capturing data such that only the last x packets are kept (ie, a kind
of ring buffer)? Any other approaches that may be helpful?

Thanks,
Keith