Re: [Wireshark-dev] [Wireshark-users] tshark or dumpcap ring buffer limitations

2010-05-27 Thread Gerald Combs
Jeff Morriss wrote: >>> I think a value of 5 or 65535 would make sense for >>> RINGBUFFER_MAX_NUM_FILES. We could also just print a warning like "Wow! >>> That's a lot of files!" instead of forcibly capping the value. >> I would think that if we continue to support files:0 (unlimited files) >>

Re: [Wireshark-dev] [Wireshark-users] tshark or dumpcap ring buffer limitations

2010-05-25 Thread Jeff Morriss
Jeff Morriss wrote: > Gerald Combs wrote: >> Jaap Keuter wrote: >>> On Thu, 20 May 2010 12:05:09 -0400, Jeff Morriss This appeared in rev 7912 and it appears that the max # of files limit was there originally because *ethereal kept the old files open so we would (prior to that comm

Re: [Wireshark-dev] [Wireshark-users] tshark or dumpcap ring buffer limitations

2010-05-21 Thread Jeff Morriss
Gerald Combs wrote: > Jaap Keuter wrote: >> On Thu, 20 May 2010 12:05:09 -0400, Jeff Morriss >>> This appeared in rev 7912 and it appears that the max # of files limit >>> was there originally because *ethereal kept the old files open so we >>> would (prior to that commit) run out of fds. >>> >>>

Re: [Wireshark-dev] [Wireshark-users] tshark or dumpcap ring buffer limitations

2010-05-21 Thread Gerald Combs
Jaap Keuter wrote: > On Thu, 20 May 2010 12:05:09 -0400, Jeff Morriss >> This appeared in rev 7912 and it appears that the max # of files limit >> was there originally because *ethereal kept the old files open so we >> would (prior to that commit) run out of fds. >> >> Any reason not to just take

Re: [Wireshark-dev] [Wireshark-users] tshark or dumpcap ring buffer limitations

2010-05-21 Thread Sake Blok
On 20 mei 2010, at 23:24, Jaap Keuter wrote: > On Thu, 20 May 2010 12:05:09 -0400, Jeff Morriss > wrote: >> [Redirecting to -dev for this question.] >> >> Jaap Keuter wrote: >>> On 05/19/2010 07:38 PM, Joseph Laibach wrote: All, I’m running a continuous capture of data. I’m trying

Re: [Wireshark-dev] [Wireshark-users] tshark or dumpcap ring buffer limitations

2010-05-20 Thread Jaap Keuter
On Thu, 20 May 2010 12:05:09 -0400, Jeff Morriss wrote: > [Redirecting to -dev for this question.] > > Jaap Keuter wrote: >> On 05/19/2010 07:38 PM, Joseph Laibach wrote: >>> All, >>> >>> I’m running a continuous capture of data. I’m trying to use a ring >>> buffer of 25000 files with an 8mb file

Re: [Wireshark-dev] [Wireshark-users] tshark or dumpcap ring buffer limitations

2010-05-20 Thread Jeff Morriss
[Redirecting to -dev for this question.] Jaap Keuter wrote: > On 05/19/2010 07:38 PM, Joseph Laibach wrote: >> All, >> >> I’m running a continuous capture of data. I’m trying to use a ring >> buffer of 25000 files with an 8mb file size. The problem is that the >> ring buffer starts overwriting af