Hello,
I'd like to use tethereal (or new dumpcap) to capture data and store it
in files in a ring buffer. The constraints are the total disk space, so
I'd like to erase old files automatically, and individual file duration
and size (neither too long in time nor too big in size).
I'm already able to limit both time and size per file, and total number
of files, but the duration timeout is resetted each time a new file is
created. What I'd like is rotating capture files every hour for example,
and have each file begin at a full hour, instead of rotating after one
hour of capturing. That would give cuts in the capture file precisely
every hour, *and* every 10 MB for example if the hourly file is bigger
than that. The timeout of the duration condition would be resetted only
when it triggerred last capture stop.
The files number limit would then limit both total disk space used by
ring buffer, and total capture duration.
Do you confirm that a combination of current capture options does not
allow this ? Then how difficult would it be to add such an option ? (I
think the only option needed would be a sort of "timeout alignment" ?)
I've had a look at capture_loop.c, and I was wondering if resetting
*only* the condition that matched instead of all the conditions would do
the trick ?
Regards,
--
Julien Leproust
