Wireshark · Ethereal-dev: Re: [Ethereal-dev] Introducing additional capture-stop capabilities

[Guy Harris <gharris@xxxxxxxxx>]

On Wed, Aug 22, 2001 at 05:49:47PM +0200, Thomas Wittwer wrote:
> We have enhanced the Ethereal capture function by two new stop mechanisms:
> a) it is now possible to configure the maximum capture duration in seconds.
> b) it is now possible to configure the maximum capture file size in
> kilobytes.

"capture_stop_conditions()" supports three stop mechanisms, one that
works on the "file size" and one that works on the "capture size".

The "file size" one checks whether the current size of the file, as
reported by "fstat()" is bigger than the specified maximum, and stops if
it is.

The "capture size" one checks whether the current size, plus the size
specified as input (which is the number of bytes written to the capture
file for the most recently written packet), is bigger than the specified
maximum, and stops if it is.

The "file size" one isn't used - and probably won't do what you'd want,
because the file size as reported by "fstat()" doesn't include any data
written to the standard I/O stream for the file but not yet flushed out
to the file by the standard I/O routines.  Is there any reason to keep
it?