Ethereal-dev: [Ethereal-dev] RE: [Ethereal-users] NEED HELP

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: "Mudium, Ravi Kumar (Ravi)" <mudium@xxxxxxxxxx>
Date: Tue, 29 Oct 2002 11:37:01 +0530
Hi Guy Harris
It is very much  useful information for my work.Thank you.
But I have one doubt whether this ring buffer feature is available in
ethereal 0.8.11 version. This is the version we are using.
The recent version seems to be 0.9.7

Regards
Ravi Kumar 

-----Original Message-----
From: Guy Harris [mailto:guy@xxxxxxxxxx]
Sent: Tuesday, October 29, 2002 2:16 AM
To: Mudium, Ravi Kumar (Ravi)
Cc: ethereal-dev@xxxxxxxxxxxx
Subject: Re: [Ethereal-users] NEED HELP


On Mon, Oct 28, 2002 at 09:25:23AM +0530, Mudium, Ravi Kumar (Ravi) wrote:
> Hi I am trying to implement a circular file so that I can avoid any crash
of
> ETHEREAL when there is no sufficient space on the disk.
> But I am not able to find out where exactly the write happens in to the
> capture file.

That's a developer's question, not a user's question, so it should have
gone to ethereal-dev@xxxxxxxxxxxx; I'm CCing that list rather than
ethereal-users.

> Can some one help me in finding out  the same.

In Ethereal, it happens in "capture_pcap_cb()".  Look for "wtap_dump".

Note, however, that the libpcap capture file format that is Ethereal's
native format doesn't support circular files - the N+1st packet in a
capture is always immediately after the Nth packet, it can never be
before that packet.

Note also that there is already a ring buffer mechanism in Ethereal that
rotates amongst several files.