Wireshark-users: Re: [Wireshark-users] tshark or dumpcap ring buffer limitations
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Jaap Keuter <jaap.keuter@xxxxxxxxx>
Date: Wed, 19 May 2010 21:21:23 +0200
Hi,

But do you really want that many files in you file system?

Thanks,
Jaap

On 05/19/2010 08:48 PM, Joseph Laibach wrote:

Jaap,
         Sounds great, but I have no clue about compiling. Looks like it's time for some more reading and experimenting.

Thanks

Joe

-----Original Message-----
From: wireshark-users-bounces@xxxxxxxxxxxxx [mailto:wireshark-users-bounces@xxxxxxxxxxxxx] On Behalf Of Jaap Keuter
Sent: Wednesday, May 19, 2010 2:35 PM
To: Community support list for Wireshark
Subject: Re: [Wireshark-users] tshark or dumpcap ring buffer limitations

Hi,

It's hardcoded, so you can get the source, increase the limit, recompile and go.

Thanks,
Jaap

On 05/19/2010 08:17 PM, Joseph Laibach wrote:

Is there a way to remove that limit or override it?

Thanks

Joe

-----Original Message-----
From: wireshark-users-bounces@xxxxxxxxxxxxx [mailto:wireshark-users-bounces@xxxxxxxxxxxxx] On Behalf Of Jaap Keuter
Sent: Wednesday, May 19, 2010 2:07 PM
To: Community support list for Wireshark
Subject: Re: [Wireshark-users] tshark or dumpcap ring buffer limitations

On 05/19/2010 07:38 PM, Joseph Laibach wrote:

All,

I'm running a continuous capture of data. I'm trying to use a ring
buffer of 25000 files with an 8mb file size. The problem is that the
ring buffer starts overwriting after 10000 files. I've tried it with
dumpcap and tshark. The command is using the -b files:25000 -b
filesize:8192. Is there a limitation to the size of the ring buffer for
dumpcap and/or tshark?

Thanks

Joe

- Wireshark V1.2.8

- Windows 2003 Server R2 64bit

- WinPcap v4.1.1



Hi,

That's a fixed limit:

jaap@host:~/src/wireshark/trunk$ grep RINGBUFFER_MAX_NUM_FILES *.h
ringbuffer.h:#define RINGBUFFER_MAX_NUM_FILES 10000

Thanks,
Jaap