Wireshark · Ethereal-dev: Re: [Ethereal-dev] Capture dialog ringbuffer behaviour

[Guy Harris <gharris@xxxxxxxxx>]

On Sun, Feb 29, 2004 at 08:24:37PM +0100, Ulf Lamping wrote:
> Do you really have a use case for this? (see below)

I don't, but I assume Laurent Deniel, who put that feature in, did, or
knew people who did, and I think I've seen other people asking how they
can do that - there might be stuff in the mail archives about this.

I think their use case is that they want to run a capture for a very
long time, but not to have a single giant capture file - they want the
file carved into smaller pieces, to cut the amount of data in a single
file and thus to make it less painful to, for example, process the file
in Ethereal.

> >>That's also the reason, that I wanted to have "Use ring buffer" checked 
> >>by default, as that's the typical thing to have.
> >
> >The typical thing to have is to capture to more than one file?  That's
> >not typical for me.
> >  
> >> Misunderstanding: typical behaviour, when you use more than one file. If 
> you use a single file (which is default) this option is pretty useless.

Then the code needs not to complain about the ring buffer setting when
Ethereal starts up:

	ethereal: Ring buffer requested, but capture isn't being saved to a
	    permanent file.
	ethereal: Ring buffer requested, but no maximum capture file size was
	    specified.

> If it's needed, it should behave just like the other settings, so "Limit 
> number of files" with a checkbox switching it on /off and a field for 
> the value (2-1024).

Yes.