Wireshark · Ethereal-users: [Ethereal-users] Question on ring buffer and duration

[Richard Bejtlich <taosecurity@xxxxxxxxx>]

Hello,

I noticed that ring buffer syntax I wrote about last year in my first
book no longer works, e.g.

bourque:/root# tethereal -n -i ngeth0 -s 1515 -a duration:3600 -b 24 -w test.lpc
tethereal: Ring buffer requested, but no maximum capture file size was
specified.

Now it seems a filesize has to be added?

bourque:/root# tethereal -n -i ngeth0 -s 1515 -a filesize:1000000 -a
duration:3600 -b 24 -w test.lpc

Can anyone explain why this was done?  Is it a sanity check to prevent
filling  a partition?

Thank you,

Richard