Wireshark · Ethereal-users: Re: [Ethereal-users] Question on ring buffer and duration

[Ulf Lamping <ulf.lamping@xxxxxx>]

Richard Bejtlich wrote:

>Hello,
>
>I noticed that ring buffer syntax I wrote about last year in my first
>book no longer works, e.g.
>
>bourque:/root# tethereal -n -i ngeth0 -s 1515 -a duration:3600 -b 24 -w test.lpc
>tethereal: Ring buffer requested, but no maximum capture file size was
>specified.
>
>Now it seems a filesize has to be added?
>
>bourque:/root# tethereal -n -i ngeth0 -s 1515 -a filesize:1000000 -a
>duration:3600 -b 24 -w test.lpc
>
>Can anyone explain why this was done?  Is it a sanity check to prevent
>filling  a partition?
>
>  
>
The -b parameter was changed, see
http://www.ethereal.com/docs/man-pages/tethereal.1.html as not all
possible capture combinations were possible through the former (more
simple) -b logic.

Regards, ULFL