The note that I submitted on this about a month back arose from a bad
misunderstanding on my part. I had not realised that the -a filesize
option is to be specified in 1000-byte units, not bytes.
This is the position as I now understand it. My experiences were based on
use of tethereal (0.10.3) under Windows/XP.
1. The current manual pages do not make clear the detailed limitations of
the ring buffer options. The option
-b number of ring buffer files [:duration]
is not accepted unless the option
-a filesize:nnnnn
is also specified. You cannot use -b without a filesize limit.
I've since found that the Capture/Start window of ethereal also
requires the filesize to be specified when "multiple files" is
selected.
2. There seems to be a minor bug in the logic that checks this filesize.
In the Ethereal Capture/Start window you can sometimes get excessive
numbers accepted. E.g. start ethereal without options, select interface
and filename, select multiple files, enter 15032385, select kilobytes
and press OK. This may not generate an error. However if you then code
15032386, you get the pop-up window saying that the filesize "cannot
exceed 2 GB" (7 times smaller !)
With tethereal, if the -a filesize: option is mistakenly coded as
15032386 or above, there is no warning message. Instead, the command
is ACCEPTED and the capture starts, but the effective filesize limit
for each capture extent IS ZERO. The result is that only one frame
is captured in each ring extent and these build up or rotate very
rapidly. The moral is to remember that the filesize option specifies
"kilobytes".
Best regards, Adrian.
Adrian Conrad, IBM UK ITS Technical Support Services
Internet - adrian_conrad@xxxxxxxxxx