URL: https://code.wireshark.org/review/gitweb?p=wireshark.git;a=commit;h=42b537ea49f1a54dff1528343a37aca35c590c62
Submitter: Evan Huus (eapache@xxxxxxxxx)
Changed: branch: master
Repository: wireshark
Commits:
42b537e by Evan Huus (eapache@xxxxxxxxx):
Reset state when cycling ring-buffer files in tshark.
This has several implications:
- we match user expectations that a ring-buffered tshark capture will run
forever without running out of resources (except where we still have leaks)
- we lose reassembly and request/response matching when the relevant packets
are split across files, but this actually makes our output more consistent
with dissecting those files after-the-fact
I have not made it configurable in this change because I'm not really sure
there's a use case for the old behaviour - if you're running a ring-buffer
capture in the first place it's because you're willing to discard old data to
limit resource usage. If you want the full dissection without breaks, just don't
use a ring buffer at all and take the resource hit in both disk and memory.
Change-Id: I7d8f84b2e6040b430b7112a45538041f2c30f489
Reviewed-on: https://code.wireshark.org/review/2669
Reviewed-by: Jörg Mayer <jmayer@xxxxxxxxx>
Reviewed-by: Evan Huus <eapache@xxxxxxxxx>
Actions performed:
from 286c191 9p: fix version detection, fix dissect_9P retval
adds 42b537e Reset state when cycling ring-buffer files in tshark.
Summary of changes:
tshark.c | 14 +++++++++-----
1 file changed, 9 insertions(+), 5 deletions(-)