Wireshark · Ethereal-dev: Re: [Ethereal-dev] Capture ringbuffer behaviour, 2nd proposal

[Ulf Lamping <ulf.lamping@xxxxxx>]

Guy Harris wrote:

> On Mon, Mar 01, 2004 at 01:25:30PM +0100, Lars Ruoff wrote:
>  
>
> > But for implementation and usability reasons it will be simpler to have
> >    
> >
> > > X Next capture file every 1______ kilobyte(s)
> > > O Next capture file every 1______ second(s)
> > >      
> > be a radio button group (where exactly one of them is selected
> >    
>
> Why?  Tethereal supports doing both at the same time:
>
>  SYNOPSYS
>         tethereal [ -a capture autostop condition ] ...
>         [ -b number of ring buffer files [:duration] ]
>
> 		...
>
>  OPTIONS
>         -a  Specify a criterion that specifies when Tethereal is
>             to stop writing to a capture file.  The criterion is
>             of the form test:value, where test is one of:
>
>             duration
>                 Stop writing to a capture file after value seconds
>                 have elapsed.
>
>             filesize
>                 Stop writing to a capture file after it reaches a
>                 size of value kilobytes (where a kilobyte is 1000
>                 bytes, not 1024 bytes).
>
>         -b  If a maximum capture file size was specified, cause
>             Tethereal to run in "ring buffer" mode, with the
>             specified number of files.  In "ring buffer" mode,
>             Tethereal will write to several capture files.  Their
>             name is based on the number of the file and on the
>             creation date and time.
>
>             When the first capture file fills up, Tethereal will
>             switch to writing to the next file, until it fills up
>             the last file, at which point it'll discard the data
>             in the first file (unless 0 is specified, in which
>             case, the number of files is unlimited) and start
>             writing to that file and so on.
>
>  
>
> > > >         If the optional duration is specified, Tethereal will
> > > >         switch also to the next file when the specified number
> > > >         of seconds has elapsed even if the current file is not
> > > >         completely fills up.
> > > >        
And I think Ethereal can handle this too.

As you mention it,
currently the "Next capture file every 1______ kilobyte(s)" is 
*required* to be set when using a ring buffer.
Is this really a requirement for the ring buffer to have this 
limitation, or would it be ok to test, if this condition *or* the other
"Next capture file every 1______ second(s)" is set?

Regards, ULFL