Wireshark

  • Riverbed Technology
  • WinPcap
the world's foremost network protocol analyzer
  • Wireshark
    • About
    • Download
    • Blog
  • Get Help
    • Ask a Question
    • FAQs
    • Documentation
    • Mailing Lists
    • Online Tools
    • Wiki
    • Bug Tracker
  • Develop
    • Get Involved
    • Developer's Guide
    • Browse the Code
    • Latest Builds

Wireshark-users: [Wireshark-users] How can get more than 1024 files with tshark ringbuffer?

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next


From: "Andrew Cuthbertson" <cuthbertson@xxxxxxxxxxxxx>
Date: Wed, 4 Jun 2008 10:05:23 +0200

Hi All

I'm trying to find some intermittant problems and need to capture packets
over a long period of time on a busy segment
I currently have in a .bat file. call "c:\tshark.exe"  -a 100000 -b 1024 -w
"trace_Rgbuf0.enc" -i 1
This creates a ring buffer of 1024 100MB files. If I increase the -b value
higher than 1024 I still only get 1024. Is there a way to have a ring buffer
of more files? I'm reluctant to have bigger than 100MB size files as they
take so long to process and the current 100GB of captured data is only 3
hours worth.

Andrew Cuthbertson





  • Follow-Ups:
    • Re: [Wireshark-users] How can get more than 1024 files with tshark ringbuffer?
      • From: Sake Blok
  • Prev by Date: Re: [Wireshark-users] problems trying to add bug to bugzilla this morning
  • Next by Date: [Wireshark-users] Help using this forum
  • Previous by thread: Re: [Wireshark-users] Question about "TCP previous segment lost" in LAN
  • Next by thread: Re: [Wireshark-users] How can get more than 1024 files with tshark ringbuffer?
  • Index(es):
    • Date
    • Thread

Wireshark and the "fin" logo are registered trademarks of the Wireshark Foundation