[Jaap Keuter <jaap.keuter@xxxxxxxxx>]

Hi,

But do you really want that many files in you file system?

Thanks,
Jaap

On 05/19/2010 08:48 PM, Joseph Laibach wrote:
> Jaap,
>          Sounds great, but I have no clue about compiling. Looks like it's time for some more reading and experimenting.
>
> Thanks
>
> Joe
>
> -----Original Message-----
> From: wireshark-users-bounces@xxxxxxxxxxxxx [mailto:wireshark-users-bounces@xxxxxxxxxxxxx] On Behalf Of Jaap Keuter
> Sent: Wednesday, May 19, 2010 2:35 PM
> To: Community support list for Wireshark
> Subject: Re: [Wireshark-users] tshark or dumpcap ring buffer limitations
>
> Hi,
>
> It's hardcoded, so you can get the source, increase the limit, recompile and go.
>
> Thanks,
> Jaap
>
> On 05/19/2010 08:17 PM, Joseph Laibach wrote:
> > Is there a way to remove that limit or override it?
> >
> > Thanks
> >
> > Joe
> >
> > -----Original Message-----
> > From: wireshark-users-bounces@xxxxxxxxxxxxx [mailto:wireshark-users-bounces@xxxxxxxxxxxxx] On Behalf Of Jaap Keuter
> > Sent: Wednesday, May 19, 2010 2:07 PM
> > To: Community support list for Wireshark
> > Subject: Re: [Wireshark-users] tshark or dumpcap ring buffer limitations
> >
> > On 05/19/2010 07:38 PM, Joseph Laibach wrote:
> > > All,
> > >
> > > I'm running a continuous capture of data. I'm trying to use a ring
> > > buffer of 25000 files with an 8mb file size. The problem is that the
> > > ring buffer starts overwriting after 10000 files. I've tried it with
> > > dumpcap and tshark. The command is using the -b files:25000 -b
> > > filesize:8192. Is there a limitation to the size of the ring buffer for
> > > dumpcap and/or tshark?
> > >
> > > Thanks
> > >
> > > Joe
> > >
> > > - Wireshark V1.2.8
> > >
> > > - Windows 2003 Server R2 64bit
> > >
> > > - WinPcap v4.1.1
> >
> > Hi,
> >
> > That's a fixed limit:
> >
> > jaap@host:~/src/wireshark/trunk$ grep RINGBUFFER_MAX_NUM_FILES *.h
> > ringbuffer.h:#define RINGBUFFER_MAX_NUM_FILES 10000
> >
> > Thanks,
> > Jaap