Wireshark · Ethereal-users: Re: [Ethereal-users] streaming capture to multiple files

[Guy Harris <guy@xxxxxxxxxxxx>]

On Oct 29, 2003, at 1:46 PM, R. Benjamin Kessler wrote:

> Hi all, I'm looking to emulate the capabilities of NAI's Sniffer where 
> you
> can perform a "capture to file" and have it save some number of files 
> of xx
> MB size.
>
> I don't necessarily need the "circular buffer" capabilities that 
> Sniffer has
> (e.g. capture up to 100 files of 32MB each, when you're done writing 
> file #
> 100, overwrite file #1, 2, 3, etc. as needed) but would like to have a 
> very
> long term capture running but have it broken into smaller, more 
> manageable
> chunks.

Current versions of Ethereal have the ability to do that.  It's had 
that "circular buffer" capability for a while (we call it a "ring 
buffer"), and it has recently added the ability to have an "infinite" 
ring buffer, i.e. it doesn't overwrite files, but just keeps writing 
new files.

See the "Use ring buffer" item in the "Capture file(s)" section of the 
"Capture Options" dialog box.  "Number of files" is the number of files 
in the circular buffer - 0 means "infinite".  To specify the size, see 
the "Rotate capture file every [N] kilobyte(s)" item in the "Capture 
limits" section of that dialog box.

From the command line (of Ethereal or Tethereal), see the "-a" and "-b" 
command-line flags.