Wireshark · Ethereal-users: Re: [Ethereal-users] Looking for a description of the ring buffer

[Guy Harris <guy@xxxxxxxxxx>]

> I read capture length to be 65535 packets and guessed the ring buffer was
> related to that.  Now I see that is the number of bytes per packet.  

Yes, it's the maximum number of bytes per packet that Ethereal will
save; 65535 means "all of the packet" (although if some link layer
supports larger packets, we'd have to raise the limit; the libpcap file
format, and, I think, some programs that read it, require a maximum
packet size to appear in the file, e.g. so they can allocate a buffer
for the packet, so we have to pick *some* value).

> I guess the ring buffer is handy when you want to limit file sizes, yet keep
> capturing.

It's mainly for running a continuous capture if

	1) you're waiting for Something Interesting to happen, but you
	   don't know when it'll happen, so you have to just start a
	   capture and wait for it to happen

and

	2) you don't want it to just keep consuming disk space

so, in effect, this lets you keep the last N kilobytes of packet data.