Ethereal-dev: Re: [Ethereal-dev] Re: [Ethereal-users] Questions on using ethereal / tethereal
Ian Schorr wrote:
1.) Why is ethereal / tethereal not capable to capture more than 10
tracefiles in ringbuffer mode ?
Very good question. I've asked before but never really found an
explanation. 10 is an arbitrarily set limit, and I don't know why it's
so low. It's also limited by "FOPEN_MAX", which appears to be 16 in
Linux but doesn't appear to have any relation to the maximum number of
fopen()s allowed. Personally, I've removed these limitations (and set a
fixed max of 1000 files), and not noticed any side-effects under Win2K,
WinXP, and Linux.
There is no problem to increase such a limit (the maximum number of
open files is usually high enough on moderm Unices, and on old ones,
a limit of 64 comes in mind). So it is safe (no impact on current code)
to increase from 10 to at least 64 without problems ...
But the question is : why do you need so many files ? and could you tune
the maximum file size instead of the number of files ...
2.) When I capture in ringbuffer mode (e.g. tethereal -a filesize:2000
-b 7
-w outfile) I get only one tracefile when I stop the capture
(with CTRL + C Buttons).
How can I get the files all separated e.g outfile_00, outfile_01, ...,
outfile_n ? (such separate outfiles are listet in the
capturedirectory when the capture is running)
The outfiles are removed once the capture is stopped if they are empty.
Laurent
