ANNOUNCEMENT: Live Wireshark University & Allegro Packets online APAC Wireshark Training Session
July 17th, 2024 | 10:00am-11:55am SGT (UTC+8) | Online

Ethereal-dev: Re: [Ethereal-dev] Stop capture after [size] broken?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: "Guy Harris" <gharris@xxxxxxxxx>
Date: Mon, 21 Jun 2004 13:07:38 -0700 (PDT)
Nicoson Dave said:
> It looks like the "Stop after [filesize]" feature has a bug.  The
> number of bytes for the filesize is computed correctly according to the
> factors kilobytes, megabytes, and gigabytes.  However, when I start a
> second capture, Ethereal keeps the multiplying factor and also inserts the
> total number of bytes computed for the last run.  So we get the factor
> twice.

If you've already done a "Stop after [filesize]" capture, and start
another capture, the size field in the Capture Options dialog box is set
to "capture_opts.buffer_size", which is in bytes, and the multiplying
factor is set to the previous value.

We should, instead, loop over all the multiplying factors equal to or less
than the previous multiplying factor, and, if "capture_opts.buffer_size"
is an exact multiple of the multiplying factor in question, set the size
field to "capture_opts.buffer_size" divided by the multiplying factor, and
set the multiplying factor to the multiplying factor in question, and exit
the loop.

If "capture_opts.buffer_size" can't be set independently of the scaling
factor - i.e., if we maintain the invariant "capture_opts.buffer_size is a
multiple of the scaling factor" - that loop isn't necessary.