Ethereal-dev: Re: [ethereal-dev] tcpdump -w - | ethereal -S -- How?

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

Date Index Thread Index Other Months All Mailing Lists
Date Prev Date Next Thread Prev Thread Next
From: Guy Harris <guy@xxxxxxxxxx>
Date: Mon, 20 Sep 1999 11:00:17 -0700 (PDT)
> Ok, thanks.  What I'm trying to figure out is a way to have ethereal
> running constantly without making it setuid root, but at the same time, not
> reading from a file that's constantly growing larger in size.

Given that Ethereal doesn't throw away captured packets, and that, once
a packet's been read, it has to keep its data hanging around in case the
user clicks on that packet in the summary display, *something's* going
to constantly grow larger in size if it's running continuously and it
keeps seeing traffic - either a file, or, if it stores that data in
allocated memory in its address space, the swap space it consumes.