I ran it on a 64 bit version of Red Hat Enterprise 4. I was doing a live capture on a busy tap to get an idea about the protocols being used and byte counts. I did not roll past 2^32 frames. Looks like 100 million was the most I saw. Since I was updating the byte counter I just updated the frame counter as well just in case.
So doing a live capture long enough I could probably roll the frame counter as well. I use the stats part often to help characterize the traffic and volume. Thanks, Todd On Mon, 2007-04-16 at 13:15 +0800, Jeff Morriss wrote: > > Todd Vollmer wrote: > > Sorry for the repost. The wiki doesn't mention putting PATCH in the > > subject line and I am new here. > > > > I have attached a patch for the protocol hierarchy statistics (-z io, > > phs). It's a simple update from a 32 bit unsigned integer to a 64 bit > > version. I am a little uncertain about the portability of the new > > include but I tied to follow how it was done else where in the code. > > It should be portable enough since Wireshark now requires 64-bit types. > And I'm all about 64-bit counters (32-bits is so, like, 1990's), but: > > - Did you actually have a capture with more than 2^32 frames? On what > OS and with how much RAM? I didn't think Wireshark could read files > that big and I certainly thought it would run out of memory before it > got that far. Just curious, really... > > - If Wireshark/tshark are going to support more than 2^32 frames, > there's more changes that should happen too: the frame numbers are > currently guint32, for example. Rollover there will mess up the > statistics the taps are gathering. _______________________________________________ Wireshark-dev mailing list Wireshark-dev@wireshark.org http://www.wireshark.org/mailman/listinfo/wireshark-dev
