Wireshark · Ethereal-dev: Re: [Ethereal-dev] Capture ringbuffer behaviour, 2nd proposal

[Guy Harris <gharris@xxxxxxxxx>]

On Mon, Mar 01, 2004 at 01:25:30PM +0100, Lars Ruoff wrote:
> But for implementation and usability reasons it will be simpler to have
> > X Next capture file every 1______ kilobyte(s)
> > O Next capture file every 1______ second(s)
> be a radio button group (where exactly one of them is selected

Why?  Tethereal supports doing both at the same time:

  SYNOPSYS
         tethereal [ -a capture autostop condition ] ...
         [ -b number of ring buffer files [:duration] ]

		...

  OPTIONS
         -a  Specify a criterion that specifies when Tethereal is
             to stop writing to a capture file.  The criterion is
             of the form test:value, where test is one of:

             duration
                 Stop writing to a capture file after value seconds
                 have elapsed.

             filesize
                 Stop writing to a capture file after it reaches a
                 size of value kilobytes (where a kilobyte is 1000
                 bytes, not 1024 bytes).

         -b  If a maximum capture file size was specified, cause
             Tethereal to run in "ring buffer" mode, with the
             specified number of files.  In "ring buffer" mode,
             Tethereal will write to several capture files.  Their
             name is based on the number of the file and on the
             creation date and time.

             When the first capture file fills up, Tethereal will
             switch to writing to the next file, until it fills up
             the last file, at which point it'll discard the data
             in the first file (unless 0 is specified, in which
             case, the number of files is unlimited) and start
             writing to that file and so on.

>>>          If the optional duration is specified, Tethereal will
>>>          switch also to the next file when the specified number
>>>          of seconds has elapsed even if the current file is not
>>>          completely fills up.