Ethereal-dev: Re: [Ethereal-dev] Re: [Ethereal-users] Questions on using ethereal / tethereal
See below:
Laurent Deniel wrote:
Ian Schorr wrote:
1.) Why is ethereal / tethereal not capable to capture more than 10
tracefiles in ringbuffer mode ?
Very good question. I've asked before but never really found an
explanation. 10 is an arbitrarily set limit, and I don't know why
it's so low. It's also limited by "FOPEN_MAX", which appears to be
16 in Linux but doesn't appear to have any relation to the maximum
number of fopen()s allowed. Personally, I've removed these
limitations (and set a fixed max of 1000 files), and not noticed any
side-effects under Win2K, WinXP, and Linux.
There is no problem to increase such a limit (the maximum number of
open files is usually high enough on moderm Unices, and on old ones,
a limit of 64 comes in mind). So it is safe (no impact on current code)
to increase from 10 to at least 64 without problems ...
So the question remains - does it make sense to change the limitation?
Does anyone have any objections or see any potential problems? Was
there a reason that this was set initially? I can't answer these questions.
But the question is : why do you need so many files ? and could you tune
the maximum file size instead of the number of files ...
One reason is because one is capturing a large amount of data, probably
across a relatively long time period, and wants the outputted files to
be manageable for post-capture analysis.
If you're monitoring a link and an event occurs, would you rather
analyze 1 4GB file, or one (or a few, depending on how accurate you can
match up event time versus timstamp on the capture device) of 20 200MB
files? What if you have to transfer the files to a remote machine for
analysis? What if you want to record a days' worth of traffic, and
realize it will consume 300GB of space? You'd want to capture 10 30GB
files? I suspect that's not even possible on some platforms.
A lesser issue would be the fact that with 10 files, every time my files
wrap and a "full" file is restarted and overwritten, 10% of my overall
data is lost - I only have 90% of the traffic potential history that I
*could* have.
What use is the ring buffer other than generating small, managable files
while capturing?
