Wireshark-users: Re: [Wireshark-users] tshark or dumpcap ring buffer limitations
Date Index · Thread Index · Other Months · All Mailing Lists
Date Prev · Date Next · Thread Prev · Thread Next
From: Jeff Morriss <jeff.morriss.ws@xxxxxxxxx>
Date: Thu, 20 May 2010 09:34:38 -0400
Joseph Laibach wrote:

Jaap,
        I work for a stock trading firm. We are looking to have a system in place to capture the entire days worth of market data. We have a line that comes in and brings multiple feeds in to our servers. We would like to be able to let this capture run and then over-write itself the next day. The 8mb files are a nice size to work with and do not due much damage when moved about across wan links. So in order to get about a day's worth of traffic at 8mb clips I need a ring buffer of about 25000 files. The traffic adds up to about 225 to 235gb a day depending on market activity. The 8mb files also work very nicely in our home grown Sequence number search web app.

Can I compile Wireshark on linux to be used on windows or do I need to compile on windows?
Keep in mind that having many thousands of files in a single directory can be very slow on some OS/file systems.