The ring buffer wrap question seems to come up a lot. What it seems people
are asking for is a wrap buffer, one which, once it reaches the end of the
buffer, it starts overwriting the beginning of the same buffer. That is
common in Sniffer and other brands. It is not something Ethereal does as I
understand it.
In Ethereal's Ring Buffer a number of files are specified with file sizes
and once the files are full the capture is finished. In other programs, lets
use Sniffer as our example, a single buffer is wrapped. You can specify the
size of this single buffer like you can with Ethereal's ring buffers but
there is only one buffer file. when the maximum size of the file is reached
Sniffer starts writing over the beginning of it. Once the end of the file is
reached it again returns to the beginning of the file and so on and so
forth.
Wrap buffers are handy if you need to leave an analyzer capturing until you
have notification that a problem has occurred and then stop it. You simply
adjust the wrap file size to accommodate the amount of time to be still
stored in the buffer once you get notified.
This is a common means of usage in the real world and would make Ethereal
much more useable. It could be done by going back to the first buffer after
the last one was used or by wrapping in the same file. Either way it would
be easy enough to train the user population. It would also stop the same
question from being asked over and over. Note that that should be taken as
an indicator of the worlds desire for this option.
I have cross posted this to the developers and documentation lists in hopes
of generating some clarification of this in the users guide and as a means
of begging the developers for this option to be looked into.
-----Original Message-----
From: pmarkham@upmail.com [mailto:pmarkham@upmail.com]
Sent: Monday, May 20, 2002 9:41 AM
To: ethereal-users@ethereal.com
Subject: [Ethereal-users] Re: "ring mode" file size
Without fully understanding the intent of your question, I assume you
realize that 10000 kbytes is 10 megs of data per file?
As a consequence of careless reading, I first played with the filesize based
on the premise that the units were bytes. File changes
do not take place rapidly when the data pipe is only a 56K dialup.... ;-)
Peter
Karlheinz Mueller wrote:
> Is it possible that these 10 Files will be used as a kind "Ring Buffer".
> If all 10 files are filled up, then Ethereal will start at the first
> file again and overwrite.
_______________________________________________
Ethereal-users mailing list
Ethereal-users@ethereal.com
http://www.ethereal.com/mailman/listinfo/ethereal-users
------------------------------------------------------------------------------
This e-mail transmission may contain information that is proprietary, privileged and/or confidential and is intended exclusively for the person(s) to whom it is addressed. Any use, copying, retention or disclosure by any person other than the intended recipient or the intended recipient's designees is strictly prohibited. If you have received this message in error, please notify the sender immediately by return e-mail and delete all copies.
==============================================================================
are asking for is a wrap buffer, one which, once it reaches the end of the
buffer, it starts overwriting the beginning of the same buffer. That is
common in Sniffer and other brands. It is not something Ethereal does as I
understand it.
In Ethereal's Ring Buffer a number of files are specified with file sizes
and once the files are full the capture is finished. In other programs, lets
use Sniffer as our example, a single buffer is wrapped. You can specify the
size of this single buffer like you can with Ethereal's ring buffers but
there is only one buffer file. when the maximum size of the file is reached
Sniffer starts writing over the beginning of it. Once the end of the file is
reached it again returns to the beginning of the file and so on and so
forth.
Wrap buffers are handy if you need to leave an analyzer capturing until you
have notification that a problem has occurred and then stop it. You simply
adjust the wrap file size to accommodate the amount of time to be still
stored in the buffer once you get notified.
This is a common means of usage in the real world and would make Ethereal
much more useable. It could be done by going back to the first buffer after
the last one was used or by wrapping in the same file. Either way it would
be easy enough to train the user population. It would also stop the same
question from being asked over and over. Note that that should be taken as
an indicator of the worlds desire for this option.
I have cross posted this to the developers and documentation lists in hopes
of generating some clarification of this in the users guide and as a means
of begging the developers for this option to be looked into.
-----Original Message-----
From: pmarkham@upmail.com [mailto:pmarkham@upmail.com]
Sent: Monday, May 20, 2002 9:41 AM
To: ethereal-users@ethereal.com
Subject: [Ethereal-users] Re: "ring mode" file size
Without fully understanding the intent of your question, I assume you
realize that 10000 kbytes is 10 megs of data per file?
As a consequence of careless reading, I first played with the filesize based
on the premise that the units were bytes. File changes
do not take place rapidly when the data pipe is only a 56K dialup.... ;-)
Peter
Karlheinz Mueller wrote:
> Is it possible that these 10 Files will be used as a kind "Ring Buffer".
> If all 10 files are filled up, then Ethereal will start at the first
> file again and overwrite.
_______________________________________________
Ethereal-users mailing list
Ethereal-users@ethereal.com
http://www.ethereal.com/mailman/listinfo/ethereal-users
------------------------------------------------------------------------------
This e-mail transmission may contain information that is proprietary, privileged and/or confidential and is intended exclusively for the person(s) to whom it is addressed. Any use, copying, retention or disclosure by any person other than the intended recipient or the intended recipient's designees is strictly prohibited. If you have received this message in error, please notify the sender immediately by return e-mail and delete all copies.
==============================================================================