Ethereal-users: RE: [Ethereal-users] Help automating Historical network capture-rollover

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Hansang Bae <hbae@xxxxxxxxxx>
Date: Fri, 18 Nov 2005 22:01:58 -0500
At 03:49 PM 11/18/2005, Cory Perry (SNL:434-951-7463) wrote:
>Not sure what I might be troubleshooting at any point in time so
>difficult to create filter. Same for packet size, if troubleshooting URL
>strings and session information, that could be deep within packet.
>
>I have thought of setting unlimited rollover but have been hitting my
>nogin against a wall trying to figure out best way to handle files and
>space management. How to automatically delete older files without
>running out of space for new files.

Then perhaps you are using the wrong tool.  I don't consider Ethereal/winpcap to be an ideal solution to long term capturing.  For that, I would consider Niksun's NetVCR.

As far as slice size goes, you rarely need to see more than 128 bytes.  Or even 256 bytes if URL is important.   For that *ONE* case where you may need to see more, you are wasting volumes of disk space.

hsb