Huge thanks to our Platinum Members Endace and LiveAction,
and our Silver Member Veeam, for supporting the Wireshark Foundation and project.

Ethereal-dev: Re: [Ethereal-dev] Capture ringbuffer behaviour, 2nd proposal

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Jason House <jhouse@xxxxxxxxx>
Date: Mon, 01 Mar 2004 13:36:20 -0500


ethereal-dev-request@xxxxxxxxxxxx wrote:


"Lars Ruoff" wrote:

Ok.
But is there really a need for having a file number limit when not using
ring buffer??

I think so. This basically boils down to creating manageable files from a single capture session without dropping packets or performing post processing.

(as in Ulfs initial proposal)
This saves us another (possibly confusing) checkbox line and ensures that
never ever will someone get the surprise that its capture has been stopped
automatically
allthough he didnt set any limits in the "capture limits" section.

I think that this is getting into personal taste and which use cases are the most common (which can change from user to user).

Forcing someone who doesn't want to use a ring buffer to enable ring buffers, and then indicate elsewhere to stop before the ring buffer would take effect seems to be non-intuitive. In addition, overwriting captured data is another potential gotcha that some would want to "never ever" happen.

How about:

O Limit capture to 2_____ files, and then
   O Stop Capture
   X Overwrite files (Ring Buffer)

In the above case, checking Stop Capture would uncheck Ring Buffer, and vice versa.

Jason.