Wireshark · Ethereal-dev: [Ethereal-dev] Re: what does "Ring buffer" mean in the capture options

[Guy Harris <gharris@xxxxxxxxx>]

On Wed, Jun 16, 2004 at 10:34:02AM +0800, Li Haijiang wrote:
> I have read the document of the readme.development and
> readme.capture.But i am still not sure about the "Ring buffer with 2
> files" in the capture options.can you give me some directions for it?

Ethereal (and Tethereal) can be configured to write a capture to more
than one file; after a given number of bytes have been written to a
file, or after a certain amount of time has passed, it'll close the file
to which it's writing and create a new file and start writing packets to
that file.

If you do that and enable the "ring buffer", then, instead of creating a
new file whenever it closes a file, it'll only do that for some number
of files and, when it has created and written to that number of files
and switches to another file, it'll empty the first file it wrote to and
start writing packets to it again, and when it finishes with that file,
it'll close it and empty the second file to which it wrote and start
writing packets to it, and so on.