Wireshark-users: [Wireshark-users] How can get more than 1024 files with tshark ringbuffer?

Date Prev · Date Next · Thread Prev · Thread Next
Date Index · Thread Index · Other Months · All Mailing Lists
From: "Andrew Cuthbertson" <cuthbertson@xxxxxxxxxxxxx>
Date: Wed, 4 Jun 2008 10:05:23 +0200
Hi All

I'm trying to find some intermittant problems and need to capture packets
over a long period of time on a busy segment
I currently have in a .bat file. call "c:\tshark.exe"  -a 100000 -b 1024 -w
"trace_Rgbuf0.enc" -i 1
This creates a ring buffer of 1024 100MB files. If I increase the -b value
higher than 1024 I still only get 1024. Is there a way to have a ring buffer
of more files? I'm reluctant to have bigger than 100MB size files as they
take so long to process and the current 100GB of captured data is only 3
hours worth.

Andrew Cuthbertson