ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Ethereal-dev: [Ethereal-dev] Stop capture after [size] broken?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Nicoson Dave" <dave.nicoson@xxxxxxxxxxx>
Date: Mon, 21 Jun 2004 11:21:20 -0500
I'm using 0.10.4 on Windows 2000 with GTK+ 2.2.4 (Glib 2.2.3) and winpcap 3.0.  It looks like the "Stop after [filesize]" feature has a bug.  The number of bytes for the filesize is computed correctly according to the factors kilobytes, megabytes, and gigabytes.  However, when I start a second capture, Ethereal keeps the multiplying factor and also inserts the total number of bytes computed for the last run.  So we get the factor twice.

Entered   Next time get
1k       1024k
2k       2048M
3M       3145728M
9M       9437184M
1M       1048576M
10M      10485760M
100M     104857600M  

Resulting in lots of this error:

Stop Capture: Requested filesize too large!

The setting "... after x byte(s)" can't be greater than 2147483647 bytes (2GB).

Can anyone confirm? 
I apologize if this is already well-known.

David Nicoson
(317) 587-4779